Ghostfolio’s PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint lacks a permission check when processing the Impersonation‑Id header. The missing authorization allows users who hold a read‑only token to assign or remove tags on portfolio holdings, a function intended for privileged accounts. This ability can corrupt portfolio categorization and the resulting financial reports, degrading the integrity and trustworthiness of the data but does not provide direct system compromise.

The flaw applies to the Ghostfolio portfolio management platform distributed by Ghostfolio. No exact version range is specified, so all releases prior to the application of the corrective patch that reinstates the missing permission validation are considered vulnerable.

Scored with a CVSS of 5.3, the vulnerability is considered moderate. The EPSS is less than 1%, indicating a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog. Attackers can exploit the flaw remotely by sending a crafted HTTPS PUT request to the tags endpoint, supplying a valid read‑only share token and an Impersonation‑Id header. No additional privileges or system compromise are required, making the attack straightforward for anyone who can obtain a read‑only token.