Description
Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Ghostfolio Ghostfolio
Default version status: unaffected
0 to ≤ 3.6.0affected
pkg:github/ghostfolio/ghostfolioReferences
- https://github.com/ghostfolio/ghostfolio/issues/7196 ↗
- https://github.com/ghostfolio/ghostfolio ↗
- https://github.com/ghostfolio/ghostfolio/commit/697ef59e3b58bebc5c21a9e482e4f5643390f316 ↗
- https://www.vulncheck.com/advisories/ghostfolio-unauthorized-portfolio-holding-tag-modification-via-missing-permission-check ↗