CVE-2026-78203

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.

CVSS 4.0

7.1CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.1CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

EPSS

0.4% chance of exploitation in the next 30 days; higher than 30% of CVEs (scores of 2026-10-25)

CWE

CWE-639

Published

2026-08-24

Modified

2026-10-12

Record from

the NVD, synced 2026-10-19

References

• https://github.com/GhostManager/Ghostwriter
• https://github.com/GhostManager/Ghostwriter/blob/v7.1.1/ghostwriter/reporting/views.py#L275-L315
• https://github.com/GhostManager/Ghostwriter/commit/5b2a4a297e44c823c16f65b1ba101c742791cd0b
• https://github.com/geo-chen/oss/blob/main/Ghostwriter.md
• https://www.vulncheck.com/advisories/ghostwriter-before-cross-client-report-template-disclosure-via-unauthorized-template-swap

Check your stackJSON