THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-59709 (MEDIUM 4.3) — Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can

[NVD] CVE-2026-59709 (MEDIUM 4.3) — Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can

lownvdPublished 2026-07-07

CVE-2026-59709 CVSS: 4.3 MEDIUM Published: 2026-07-07T15:16:49.430

Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting

MITRE ATT&CK techniques

ImpersonationT1684.001
ImpersonationAML.T0073

Indicators of compromise

CVE-2026-59709cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-59709