CVE-2026-78203: Ghostwriter Information Disclosure Flaw

CVE-2026-78203 Overview

CVE-2026-78203 is an authorization flaw in Ghostwriter, an open-source reporting platform for offensive security engagements. Versions before 7.1.2 fail to validate template ownership in the report template swap endpoint. Authenticated attackers can attach client-scoped templates belonging to other clients to their own reports. The endpoint uses sequential template primary keys, allowing enumeration of foreign template identifiers. Once attached, generating a report discloses the template contents, including letterhead, boilerplate, and methodology text of unrelated clients. The issue is tracked as an Insecure Direct Object Reference weakness [CWE-639].

Critical Impact
Authenticated users can enumerate sequential template IDs and disclose confidential letterhead, boilerplate, and methodology content scoped to other clients.

Affected Products

Ghostwriter versions prior to 7.1.2
Ghostwriter v7.1.1 report template swap endpoint (ghostwriter/reporting/views.py)
Ghostwriter command center default template form (ghostwriter/commandcenter/forms.py)

Discovery Timeline

2026-08-24 - CVE-2026-78203 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78203

Vulnerability Analysis

Ghostwriter allows report templates to be scoped to specific clients, enforcing tenant-style separation between engagements. The report template swap endpoint accepts a template primary key from the requesting user but does not verify that the referenced template belongs to a client the user is authorized to access. Because template primary keys are sequential integers, an attacker iterates values to identify valid foreign templates. After swapping in a foreign template, the attacker triggers report generation and receives the rendered output containing the target client's confidential content.

Root Cause

The underlying weakness is a missing ownership check on a user-controlled object reference. The default_docx_template handling and the archive generation path both accepted templates without verifying that the template's client_id was compatible with the report's client. The patch introduces can_apply_to_report(report) checks and rejects client-scoped templates being used as global defaults, closing the gap in both surfaces.

Attack Vector

Exploitation requires an authenticated low-privilege account on the Ghostwriter instance. The attacker submits template swap requests referencing enumerated primary keys through the network-facing web interface. No user interaction from the victim is required. The impact is confidentiality-focused: disclosure of client-scoped template contents that the attacker's account is not authorized to view.

python

# Patch: ghostwriter/commandcenter/forms.py
def clean_default_docx_template(self):
    docx_template = self.cleaned_data["default_docx_template"]
    if docx_template:
        if docx_template.client_id is not None:
            raise ValidationError(
                _("Global default Word templates cannot be scoped to a client"),
                "invalid",
            )
        docx_template_status = docx_template.get_status()
        if docx_template_status in ("error", "failed"):
            raise ValidationError(

# Patch: ghostwriter/reporting/archive.py
if not docx_template.can_apply_to_report(report):
    raise ValueError("The selected Word template is not available for this report.")
if not pptx_template.can_apply_to_report(report):
    raise ValueError("The selected PowerPoint template is not available for this report.")

Source: Ghostwriter security commit 5b2a4a29

Detection Methods for CVE-2026-78203

Indicators of Compromise

Sequential requests to the report template swap endpoint referencing incrementing template primary keys from a single authenticated session.
Report generation events where the applied template's client_id does not match the report's associated client.
Unexpected document downloads containing letterhead or methodology belonging to unrelated clients.

Detection Strategies

Review Ghostwriter application logs for template swap actions and correlate the acting user, report client, and template client_id for mismatches.
Enable Django audit logging on the reporting views to capture template assignment changes with full request context.
Alert on high-volume template swap or report generation activity from non-administrative accounts.

Monitoring Recommendations

Forward Ghostwriter web and application logs to a centralized analytics platform for retention and correlation.
Baseline normal per-user template swap frequency and alert on statistical outliers.
Track error responses from the patched can_apply_to_report check after upgrade to identify probing activity.

How to Mitigate CVE-2026-78203

Immediate Actions Required

Upgrade Ghostwriter to version 7.1.2 or later, which introduces ownership enforcement in the template swap and archive code paths.
Audit existing reports for templates whose client_id does not match the report's client and investigate the associated user activity.
Rotate or revoke access for low-privilege accounts suspected of enumeration prior to the upgrade.

Patch Information

The fix is delivered in commit 5b2a4a297e44c823c16f65b1ba101c742791cd0b, which adds can_apply_to_report(report) validation in ghostwriter/reporting/archive.py and rejects client-scoped templates as global defaults in ghostwriter/commandcenter/forms.py. See the VulnCheck Security Advisory and the Ghostwriter repository for release notes.

Workarounds

Restrict Ghostwriter access to trusted operators until the 7.1.2 upgrade is applied.
Temporarily remove or archive sensitive client-scoped templates that must not be exposed cross-tenant.
Place the Ghostwriter instance behind a reverse proxy that rate-limits requests to the template swap endpoint.

bash

# Upgrade Ghostwriter to the patched release
git fetch --tags
git checkout v7.1.2
docker compose pull
docker compose up -d