CVE-2026-59709
Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check
CVSS 4.0 5.3 MEDIUMCVSS 3.1 4.3 MEDIUMCheck source for fixed versionsKEV status unknown
cve-program · CVE-2026-59709
PublishedGhostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-59709 · CVE overview and exploitation status
cve-program · CVE-2026-59709
- https://github.com/ghostfolio/ghostfolio/issues/7196
- https://github.com/ghostfolio/ghostfolio
- https://github.com/ghostfolio/ghostfolio/commit/697ef59e3b58bebc5c21a9e482e4f5643390f316
- https://www.vulncheck.com/advisories/ghostfolio-unauthorized-portfolio-holding-tag-modification-via-missing-permission-check
Related changes
Linked by CVE identifierNo related changes are available here.