CVE-2026-78204 Overview
CVE-2026-78204 is a missing authorization vulnerability in Ghostwriter through version 7.2.6. The flaw affects the report template lint endpoints, which fail to enforce per-object authorization on ReportTemplate records. Any authenticated user can lint arbitrary templates and read the returned findings regardless of ownership or client scope. The vulnerability maps to CWE-862: Missing Authorization.
Critical Impact
Authenticated attackers can enumerate template structure, variable names, and template-engine errors across tenants, and overwrite stored lint results for templates they do not own.
Affected Products
- Ghostwriter through version 7.2.6
- RoleBasedAccessControlMixin.test_func in ghostwriter/api/utils.py
- Report template lint and stored lint result endpoints
Discovery Timeline
- 2026-08-24 - CVE-2026-78204 published to NVD
- 2026-08-26 - Last updated in NVD database
Technical Details for CVE-2026-78204
Vulnerability Analysis
Ghostwriter is an open-source reporting and project management platform used by offensive security teams. The application implements role-based access control through a Django mixin, RoleBasedAccessControlMixin, whose test_func method returns only request.user.is_active unless a view overrides it.
Two endpoints related to report template linting do not override test_func. The first endpoint runs the linter against a ReportTemplate resolved from a caller-supplied primary key. The second endpoint returns the stored lint results for that template. Neither endpoint checks whether the requesting user owns the template or belongs to the associated client scope.
As a result, any authenticated account, regardless of role or client assignment, can invoke these endpoints against arbitrary template IDs. The impact includes disclosure of template internals and unauthorized modification of stored lint state. See the VulnCheck Security Advisory for advisory details.
Root Cause
The root cause is reliance on a permissive default authorization check. RoleBasedAccessControlMixin.test_func authorizes any active user by default. Views that operate on tenant-scoped objects are expected to override this method to enforce per-object checks. The lint endpoints omit that override, leaving object-level authorization absent.
Attack Vector
An attacker requires only valid authenticated credentials to any active account on the Ghostwriter instance. The attacker enumerates template primary keys and issues requests to the lint endpoint and the stored lint results endpoint. The lint response reveals variable names and template-engine errors that disclose the template structure. Repeated linting overwrites the stored lint result for each targeted template.
The vulnerability is distinct from the template swap path, which authorizes the report but omits the per-template check. The lint endpoints omit authorization entirely and, per the advisory, remain unfixed.
No verified exploit code is publicly available. Refer to the Ghostwriter source at v7.2.6 and the third-party technical writeup for implementation context.
Detection Methods for CVE-2026-78204
Indicators of Compromise
- Requests to report template lint endpoints from user accounts that do not own the referenced ReportTemplate primary key.
- Unexpected changes to stored lint results on templates, including timestamps and result content from unrelated users.
- Sequential enumeration patterns targeting incrementing template primary keys from a single authenticated session.
Detection Strategies
- Correlate Django access logs with template ownership data to flag lint requests where the authenticated user is outside the template's client scope.
- Alert on high-volume lint API calls from a single account within a short window, which indicates enumeration behavior.
- Review audit trails for stored lint result mutations that do not correspond to legitimate template authoring workflows.
Monitoring Recommendations
- Enable verbose logging on the Ghostwriter API layer, capturing user identity, requested template ID, and endpoint path.
- Forward Ghostwriter application logs to a centralized logging or SIEM platform for cross-user correlation.
- Baseline normal lint activity per user and per client scope, then alert on deviations.
How to Mitigate CVE-2026-78204
Immediate Actions Required
- Restrict access to the Ghostwriter instance to trusted operators only, and audit all active user accounts.
- Disable or firewall the report template lint endpoints at the reverse proxy until an official fix is released.
- Rotate credentials for any account whose activity cannot be reconciled with legitimate template work.
Patch Information
At the time of publication, no vendor patch is available. The advisory states the lint endpoints remain unfixed in Ghostwriter through version 7.2.6. Monitor the Ghostwriter GitHub repository for future releases that add a test_func override enforcing per-object authorization on the lint views.
Workarounds
- Apply a local patch that overrides test_func in the lint views to verify the requesting user owns or has client-scope access to the target ReportTemplate.
- Place the Ghostwriter API behind a reverse proxy that enforces path-based access rules for the lint endpoints.
- Reduce the number of authenticated users on the instance and enforce least-privilege role assignments until a vendor fix is released.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
