CVE-2026-59709
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint in Ghostfolio fails to verify the Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.
Risk Assessment
The risk involves unauthorized modification of portfolio data by an attacker with read-only access, potentially leading to incorrect asset categorization and false reports, impacting investment decisions and system integrity.
Recommendation
Immediately update Ghostfolio to a version that fixes the permission verification in the PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint, and review all active read-only access tokens for potential abuse.
Original NVD description (English source)
Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.