CVE-2026-78203 in Ghostwriter
Summary
by MITRE • 08/24/2026
Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/24/2026
The vulnerability identified in Ghostwriter versions prior to 7.1.2 represents a critical failure in access control mechanisms within the report generation subsystem. Specifically, the endpoint responsible for swapping or attaching templates to reports lacks proper validation of template ownership relative to the authenticated user's client scope. This architectural flaw allows an attacker who has obtained valid credentials for one client account to interact with API endpoints that are intended to be isolated per tenant. By manipulating the parameters sent to this endpoint, a malicious actor can bypass logical access controls and associate templates belonging to other clients within the same Ghostwriter instance with their own reports.
The exploitation of this vulnerability relies heavily on the database schema design, particularly how primary keys for template objects are assigned. In many implementations, these identifiers follow sequential integer patterns rather than being cryptographically random or universally unique identifiers that obscure relationships between records. This predictability enables attackers to perform enumeration attacks by iterating through potential primary key values. By systematically testing different identifier ranges, an attacker can discover templates belonging to other clients without needing prior knowledge of their specific IDs. Once a foreign template is identified, the lack of ownership verification allows the attacker to attach it to a report under their control.
The operational impact of this vulnerability extends beyond simple data leakage within a single organization. Because Ghostwriter is often used by penetration testing firms and security consultancies to generate formal assessment reports, these documents contain highly sensitive intellectual property and proprietary methodologies. The ability to access foreign templates means an attacker can retrieve letterhead designs, boilerplate text, standard disclaimers, and unique methodology descriptions that are specific to competing or unrelated organizations. This disclosure compromises the confidentiality of trade secrets and professional assets, potentially leading to competitive disadvantage or reputational damage for the affected clients. Furthermore, if these templates contain embedded instructions or macros, there is a secondary risk of code execution upon report generation in certain configurations, although the primary concern remains data exfiltration.
From a classification perspective, this vulnerability aligns with CWE-284 Improper Access Control and CWE-359 Exposure of Private Information to an Unauthorized Actor. The failure to enforce tenant isolation is a classic example of broken object level authorization (BOLA), which is frequently cataloged under the MITRE ATT&CK technique T1078 Valid Accounts when combined with credential theft, or more specifically as part of data exfiltration via API abuse. The sequential enumeration aspect relates to CWE-203 Observable Discrepancy and contributes to information gathering activities that facilitate further attacks within the environment.
Mitigation strategies must focus on immediate patching and long-term architectural improvements. Organizations running Ghostwriter versions earlier than 7.1.2 should upgrade to the latest stable release where this validation logic has been corrected. In addition to upgrading, administrators should review their API gateway configurations to ensure that all endpoints enforce strict tenant isolation checks at the application layer, not just relying on database constraints. It is also advisable to implement rate limiting and anomaly detection on template-related APIs to mitigate enumeration attempts. For environments where immediate patching is not feasible, network-level segmentation restricting access to the Ghostwriter instance can reduce the attack surface for external adversaries attempting to exploit this flaw.