CyberRota Analysis
AI-GeneratedThe vulnerability affects Ghostfolio's API, specifically the PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint, which improperly verifies the Access.permissions field when handling the Impersonation-Id header. This flaw allows attackers with valid read-only share tokens to modify portfolio holding tags, potentially corrupting portfolio categorization and reports. Organizations using Ghostfolio should prioritize addressing this issue to prevent unauthorized modifications to sensitive financial data.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id header, allowing read-only access grantees to modify portfolio holding tags. Attackers with valid read-only share tokens can assign or remove tags on victim holdings, corrupting portfolio categorization and reports.