Vulnerability · Published Jul 7, 2026 · Assigned by VulnCheck
CVE-2026-59709Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check
Medium 4.3
In plain English
A medium-severity missing authorization in Ghostfolio from Ghostfolio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).
Severity (CVSS 3.1)4.3Medium
Exploit odds (30 days)0.3%top 72.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ghostfolio | Ghostfolio | 0 – through 3.6.0 |
Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
References
- GitHub Issue issue-tracking
- Product product
- Patch Commit patch
- https://www.vulncheck.com/advisories/ghostfolio-unauthorized-portfolio-holding-tag-modification-via-missing-permission-check third-party-advisory