CVE-2026-59709 Ghostfolio CVE debrief

Who should care

Defenders managing Ghostfolio deployments, especially those with multiple users or integrations, should assess exposure and prioritize remediation based on the CVSS score of 5.3 and MEDIUM severity. They should verify and remediate this vulnerability, review and restrict Impersonation-Id header usage, and monitor portfolio holding tag modifications for suspicious activity.

Why it matters

CVE-2026-59709 allows read-only users to modify portfolio holding tags in Ghostfolio via the Impersonation-Id header. Defenders should verify and remediate this vulnerability, especially in multi-user deployments.

• Verify and restrict Impersonation-Id header usage to prevent unauthorized modifications
• Monitor portfolio holding tag modifications for suspicious activity
• Review and update access controls for portfolio holdings

Technical summary

The Ghostfolio PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint does not verify the Access.permissions field when processing the Impersonation-Id header. This allows grantees with read-only access to modify portfolio holding tags, potentially corrupting portfolio categorization and reports. The vulnerability has a CVSS score of 5.3 and MEDIUM severity, emphasizing the need for defenders to assess exposure and prioritize remediation in Ghostfolio deployments, especially those with multiple users or integrations.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Ghostfolio deployments, especially those with multiple users or integrations.

Recommended defensive actions

• Verify and apply the patch from Ghostfolio
• Review and restrict Impersonation-Id header usage
• Monitor portfolio holding tag modifications for suspicious activity
• Review access controls for portfolio holdings
• Verify affected scope and severity
• Plan vendor-supported updates or mitigations
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its CVSS score of 5.3 and MEDIUM severity. However, additional information on affected versions, exploitation, or remediation is limited. Defenders should verify and remediate this vulnerability, especially in multi-user deployments, and monitor portfolio holding tag modifications for suspicious activity.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.