CVE-2026-78203 — Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap
Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to th…
Published: 2026-08-24 · CVSS: 7.1 · CVSS 4.0
Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7