CVE-2026-78203

Name of the Vulnerable Software and Affected Versions Ghostwriter versions prior to 7.1.2

Description Ghostwriter fails to validate template ownership in the report template swap endpoint. This allows attackers to attach client-scoped templates belonging to other clients to their own reports by exploiting sequential template primary keys to enumerate and attach foreign templates. Consequently, attackers can generate reports to disclose sensitive template contents, such as letterhead, boilerplate, and methodology text.

Recommendations Update Ghostwriter to version 7.1.2 or later.