HIGH 7.1 NVD
CVE-2026-78203
Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from ot
Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.
References
- https://github.com/GhostManager/Ghostwriter
- https://github.com/GhostManager/Ghostwriter/blob/v7.1.1/ghostwriter/reporting/views.py#L27
- https://github.com/GhostManager/Ghostwriter/commit/5b2a4a297e44c823c16f65b1ba101c742791cd0
- https://github.com/geo-chen/oss/blob/main/Ghostwriter.md
- https://www.vulncheck.com/advisories/ghostwriter-before-cross-client-report-template-discl
This high severity vulnerability with a CVSS score of 7.1 was published on 2026-08-24 via NVD.
vulnfeed aggregates 10945 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.