CVE-2026-78204— Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints
Quick assessment
Affected
GhostManager Ghostwriter
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ghostwriter 7.2.6 及更早版本在其报告模板语法检查端点上未实施基于对象的权限控制。 方法仅在视图未覆盖该方法时返回 的状态；而负责报告模板语法检查的端点以及返回已存储的语法检查结果的端点均未进行覆盖，因此这两个端点都会根据调用方提供的模板主键直接解析出 对象，且未进行任何所有权或客户端作用域校验。 因此，任何经过身份验证的用户均可对任意模板执行语法检查操作，从而覆盖该模板的已存储语法检查结果，并读取返回的检查发现信息。这些发现信息会列出模板中的变量名称和模板引擎错误等细节，进而暴露模板的内部结构。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| GhostManager | Ghostwriter | ≤ 7.2.6 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-78204
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored lint results provides an override, so each resolves a ReportTemplate from a caller-supplied primary key with no ownership or client-scope check. Any authenticated account can therefore lint an arbitrary template, which overwrites that template's stored lint result, and can read the returned findings, which enumerate the template's variable names and template-engine errors and so disclose its structure. This is distinct from the template swap path: that endpoint authorizes the report but omits the per-template check, whereas these endpoints omit authorization entirely and remain unfixed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| GhostManager | Ghostwriter | 0 ~ 7.2.6 | - |
|
II. Public POCs for CVE-2026-78204
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-78204
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-78204 (1)
Vendor Advisories for CVE-2026-78204 (1)
Security Blog Posts for CVE-2026-78204 (1)
Other References for CVE-2026-78204 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-78204
No comments yet