EUVD-2026-42046
GHSA-w8j2-252j-wp53
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network API exploitable with low-privilege share token; no scope change or confidentiality/availability impact, only limited tag integrity modification.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.
AnalysisAI
Ghostfolio's portfolio sharing impersonation feature exposes a missing authorization check on the PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint, allowing holders of read-only share tokens to modify portfolio holding tags they should only be able to view. Any user granted read-only access to another user's portfolio can exploit this flaw to assign or remove tags on holdings, silently corrupting the victim's portfolio categorization, reporting, and analytics. No public exploit code has been identified at time of analysis, and this vulnerability is not currently listed in the CISA KEV catalog.
Technical ContextAI
Ghostfolio is an open-source self-hosted wealth management and portfolio tracking application (cpe:2.3:a:ghostfolio:ghostfolio:*:*:*:*:*:*:*:*). The application supports portfolio sharing via access tokens that encode permission levels in an Access.permissions field. When a share token is used through the Impersonation-Id HTTP header, the PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags handler fails to validate the Access.permissions field before processing write operations, violating the principle of least privilege. The root cause is CWE-862 (Missing Authorization): the server authenticates the impersonation token but does not authorize the specific action against the token's declared permission scope, treating the authenticated identity as implicitly authorized for all operations on the impersonated account.
RemediationAI
The primary fix is to update Ghostfolio to the version incorporating commit 697ef59e3b58bebc5c21a9e482e4f5643390f316, which addresses the missing permission check in the tag modification endpoint; the exact release version number is not independently confirmed from available data, so operators should verify against the upstream changelog at https://github.com/ghostfolio/ghostfolio. As an interim compensating control, administrators can disable or revoke all active read-only share tokens via the Ghostfolio access management interface, which eliminates the attack surface at the cost of disrupting any legitimate read-only sharing arrangements. Alternatively, network-level controls restricting the PUT /api/v1/portfolio/holding/ route to authenticated owner sessions only (e.g., via a reverse proxy that strips Impersonation-Id headers unless the request originates from the owner) would mitigate exploitation without revoking tokens, though this requires careful configuration to avoid breaking legitimate impersonation flows.
More in Ghostfolio
View allSame weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today