CVE-2026-78204

Name of the Vulnerable Software and Affected Versions Ghostwriter versions prior to 7.2.7

Description Ghostwriter fails to apply per-object authorization on its report template lint endpoints. The RoleBasedAccessControlMixin.test func function only verifies if request.user.is active is true unless overridden by a view. Because the endpoints for linting a report template and returning stored lint results do not provide this override, they resolve a ReportTemplate using a caller-supplied primary key without verifying ownership or client-scope. Consequently, any authenticated user can lint an arbitrary template, overwriting its stored lint result and reading findings that disclose the template structure by enumerating variable names and template-engine errors.

Recommendations Update Ghostwriter to version 7.2.7 or later.