CVE-2026-59709: Ghostfolio Auth Bypass Vulnerability

CVE-2026-59709 Overview

CVE-2026-59709 is a missing authorization vulnerability [CWE-862] in Ghostfolio, an open-source wealth management application. The PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint does not verify the Access.permissions field when processing the Impersonation-Id header. Read-only share token holders can therefore modify tags on portfolio holdings owned by other users. Attackers can add or remove tags to corrupt portfolio categorization, dashboards, and generated reports without gaining full account access.

Critical Impact
Users granted read-only access via share tokens can tamper with holding tags on victim portfolios, undermining the integrity of portfolio categorization and downstream reports.

Affected Products

Ghostfolio (open-source wealth management application)
Deployments exposing the /api/v1/portfolio/holding/:dataSource/:symbol/tags PUT endpoint
Instances using the share-token / Impersonation-Id access model

Discovery Timeline

2026-07-07 - CVE-2026-59709 published to the National Vulnerability Database (NVD)
2026-07-09 - Last updated in NVD database

Technical Details for CVE-2026-59709

Vulnerability Analysis

Ghostfolio supports an impersonation model where users can share read-only access to their portfolio via a share token. Clients pass the target user identifier through the Impersonation-Id HTTP header, and the backend enforces an Access.permissions field to restrict what the grantee can perform.

The handler for PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags accepts the impersonation header but omits the permission check. As a result, any caller holding a valid read-only share token for a given user can issue tag update requests against that user's holdings. The vulnerability is a server-side authorization flaw, not a client-side control issue, so restricting the UI does not mitigate it.

Successful requests do not exfiltrate sensitive data or execute code. They do corrupt holding categorization, which propagates into portfolio grouping, allocation views, and generated reports.

Root Cause

The root cause is a missing authorization check [CWE-862] in the tags update route. The endpoint trusts the presence of a valid Impersonation-Id and share token without verifying that the token's Access.permissions grants write privileges for holding metadata. See the VulnCheck Security Advisory and GitHub Issue Discussion for maintainer confirmation.

Attack Vector

Exploitation requires network access to the Ghostfolio API and a valid read-only share token issued by a target user. The attacker sends an authenticated PUT request to /api/v1/portfolio/holding/:dataSource/:symbol/tags with the victim's identifier in the Impersonation-Id header and a JSON body containing the desired tag set. The server applies the change to the victim's holding without evaluating write permissions.

The security patch and remediation details are documented in the GitHub Commit Details and the upstream GitHub Project Repository. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2026-59709

Indicators of Compromise

PUT requests to /api/v1/portfolio/holding/:dataSource/:symbol/tags that include an Impersonation-Id header referencing a user other than the authenticated caller.
Unexpected changes to holding tags in the Ghostfolio database, especially tag additions or removals occurring outside normal user activity windows.
Repeated tag-update requests from clients associated with read-only share tokens.

Detection Strategies

Enable API access logging on the Ghostfolio backend and alert on tag-endpoint calls that carry the Impersonation-Id header.
Correlate share-token issuance events with subsequent write operations on the tags endpoint to identify permission escalation attempts.
Baseline normal tag-change frequency per user, then flag statistical deviations for review.

Monitoring Recommendations

Forward reverse proxy or application logs to a centralized logging platform and retain request method, path, headers, and authenticated user identity.
Alert on any 4xx-to-2xx transitions on the tags endpoint after deploying the patch, which may indicate probing.
Periodically export holding tag state and diff against known-good snapshots to detect silent tampering.

How to Mitigate CVE-2026-59709

Immediate Actions Required

Upgrade Ghostfolio to the fixed release that includes the permission check for the tags endpoint, as referenced in the GitHub Commit Details.
Audit active share tokens and revoke any tokens issued to untrusted parties.
Review recent tag changes on portfolio holdings and restore known-good values where tampering is suspected.

Patch Information

The maintainers addressed the issue in the Ghostfolio repository by adding the missing Access.permissions verification on the PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags handler. Refer to the GitHub Commit Details and the VulnCheck Security Advisory for the exact fixed version and remediation notes.

Workarounds

Restrict issuance of read-only share tokens to trusted users until the patch is applied.
Place the Ghostfolio API behind a reverse proxy rule that blocks PUT requests to /api/v1/portfolio/holding/*/tags when an Impersonation-Id header is present.
Rotate all share tokens after upgrading to invalidate any tokens that may have been abused.

bash

# Example NGINX rule to block impersonated tag writes until patched
location ~ ^/api/v1/portfolio/holding/[^/]+/[^/]+/tags$ {
    if ($request_method = PUT) {
        if ($http_impersonation_id) {
            return 403;
        }
    }
    proxy_pass http://ghostfolio_backend;
}