Authorization Issue in Ghostwriter Report Template by GhostManager
CVE-2026-78204

5.3MEDIUM

Key Information:

Vendor

Ghostmanager

Status
Ghostwriter
Vendor
CVE Published:
24 August 2026

What is CVE-2026-78204?

Ghostwriter versions up to 7.2.6 exhibit a significant authorization flaw within their report template lint endpoints. These endpoints lack per-object authorization checks, allowing any authenticated user to lint arbitrary report templates. This vulnerability arises because the system does not enforce ownership or client-scope checks during the linting process. Consequently, an unauthorized user can not only access sensitive lint results that reveal template structure, including variable names and errors, but also overwrite existing lint results. This misconfiguration poses serious risks, as it undermines the integrity and confidentiality of the report templates.

Affected Version(s)

Ghostwriter 0 <= 7.2.6

References

https://github.com/GhostManager/Ghostwriter
product
https://github.com/GhostManager/Ghostwriter/blob/v7.2.6/g...
technical-description
https://github.com/geo-chen/oss/blob/main/Ghostwriter.md
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

George Chen
.