---
id: CVE-2026-78203
title: >-
  Ghostwriter before 7.1.2 fails to validate template ownership in the report
  template swap endpoint, allowing attackers to attach client-scoped templates
  from other clients to their own reports
summary: >-
  Ghostwriter before 7.1.2 fails to validate template ownership in the report
  template swap endpoint, allowing attackers to attach client-scoped templates
  from other clients to their own reports. Attackers can exploit sequential
  template p…
severity: high
cvss: 7.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N'
cwe:
  - CWE-639
published: '2026-08-24'
updated: '2026-10-12'
sourceUpdated: '2026-10-12T16:10:00.220'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-78203'
references:
  - url: 'https://github.com/GhostManager/Ghostwriter'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/GhostManager/Ghostwriter/blob/v7.1.1/ghostwriter/reporting/views.py#L275-L315
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/GhostManager/Ghostwriter/commit/5b2a4a297e44c823c16f65b1ba101c742791cd0b
    label: disclosure@vulncheck.com
  - url: 'https://github.com/geo-chen/oss/blob/main/Ghostwriter.md'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/ghostwriter-before-cross-client-report-template-disclosure-via-unauthorized-template-swap
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00369
epssPercentile: 0.28817
ingestedAt: '2026-10-12T16:57:59.899Z'
---

## Overview

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.