CVE-2026-59709 MEDIUM

CVE-2026-59709: Ghostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check

Vendor Ghostfolio
Product Ghostfolio
Weakness CWE-862 · Missing authorization
Published July 7, 2026
Last update July 20, 2026
View on NVD All CVEs

CVSS base score

5.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.

Key dates

02Disclosure timeline

July 7, 2026 CVE published
July 20, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-28159 WordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability CVE-2026-66699 WordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability CVE-2026-73353 WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability CVE-2026-73403 WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability CVE-2026-66441 WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability