Cross-Client Report Template Vulnerability in Ghostwriter Software

CVE-2026-78203

What is CVE-2026-78203?

Ghostwriter versions before 7.1.2 contain a vulnerability that fails to properly validate the ownership of templates in the report template swap endpoint. This oversight permits attackers to exploit sequential template primary keys, enabling them to enumerate and attach client-scoped templates belonging to other clients to their own reports. Consequently, this leads to unauthorized access to sensitive template contents such as letterhead, boilerplate text, and methodology information, posing a significant risk to data confidentiality.

References