Description
Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ghostfolio | Ghostfolio | — | — |
References
- GitHub Issue issue-tracking
- Product product
- Patch Commit patch
- https://www.vulncheck.com/advisories/ghostfolio-unauthorized-portfolio-holding-tag-modification-via-missing-permission-check third-party-advisory