CVE-2026-59709

Name of the Vulnerable Software and Affected Versions Ghostfolio (affected versions not specified)

Description An issue exists where the 'PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags' endpoint fails to verify the Access.permissions field when processing the Impersonation-Id header. This allows users with read-only access tokens to modify portfolio holding tags, enabling the assignment or removal of tags on holdings they should not be able to edit, which can lead to the corruption of portfolio categorization and reports.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.