CVE-2026-78204
Received Received - Intake

Authentication Bypass in Ghostwriter Report Templates

Publication date: 2026-08-24

Last updated on: 2026-08-24

Assigner: VulnCheck

Description
Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored lint results provides an override, so each resolves a ReportTemplate from a caller-supplied primary key with no ownership or client-scope check. Any authenticated account can therefore lint an arbitrary template, which overwrites that template's stored lint result, and can read the returned findings, which enumerate the template's variable names and template-engine errors and so disclose its structure. This is distinct from the template swap path: that endpoint authorizes the report but omits the per-template check, whereas these endpoints omit authorization entirely and remain unfixed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-24
Last Modified
2026-08-24
Generated
2026-08-24
AI Q&A
2026-08-24
EPSS Evaluated
N/A
NVD
CVE-2026-78204
EUVD
EUVD-2026-64679

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
ghostwriter ghostwriter to 7.2.6 (inc)
specterops ghostwriter to 7.2.6 (inc)
specterops ghostwriter to 7.1.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Ghostwriter through version 7.2.6 has a missing authorization vulnerability in its report template lint endpoints. The application fails to enforce proper access controls, allowing any authenticated user to manipulate report templates by supplying a primary key without verifying ownership or client scope. This enables overwriting stored lint results and reading findings that disclose template structure, including variable names and errors.

Detection Guidance

To detect this vulnerability, check Ghostwriter's API endpoints for report template lint functionality. Verify if unauthenticated or low-privileged users can access endpoints like /api/templates/<id>/lint/ or /api/templates/<id>/lint/results/. Test by sending authenticated requests to these endpoints with arbitrary template IDs and observe if responses reveal template structure or allow overwriting lint results.

Impact Analysis

An attacker with authenticated access could modify report templates, overwrite lint results, or extract sensitive information about template structure. This could lead to unauthorized changes in reports, data leakage, or potential disruption of report generation processes.

Compliance Impact

This vulnerability could impact compliance by allowing unauthorized access to sensitive report data, potentially violating confidentiality requirements in GDPR or HIPAA. Unauthorized template modifications could also compromise data integrity, a key requirement in both regulations.

Mitigation Strategies

Upgrade Ghostwriter to a version that includes proper authorization checks for report template lint endpoints. If an upgrade is not immediately possible, restrict access to authenticated users with verified ownership of templates and disable direct template linting functionality until a patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-78204. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart