Ghostwriter v7.1.1 Client Template Isolation Bypass leads to Data Leakage

Vulnerability Overview Title: Authenticated users can assign and render another client's report template, leaking cross-client template content Affected Versions: <= 7.1.1 (Confirmed in commit 625a26b) CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CWE: CWE-639 - Authorization Bypass Through User-Controlled Key Summary: Report templates in Ghostwriter can be scoped to a specific client, ensuring that one participating team cannot view another client's proprietary templates (letterheads, branding, templates, methodology, and custom Jinja2 logic). A non-privileged user (role ) assigned to a single project can assign client-scoped templates from other clients to their own reports, then generate the reports, thereby receiving content from other clients' reports. This leaks content within the report templates that the user is not authorized to see. The fix in 7.1.1 (GHSA-hx63-6hvp-4rpv) closed direct template download URLs but did not close the template swap and report generation paths, which achieve the same data exposure. Impact Any low-privilege user (role ) assigned to a single project can read the content of report templates belonging to other clients, breaking the client scoping intended to separate participating teams in multi-client deployments. Report templates typically contain client letterheads, logos, confidentiality statements, methodology wording, and report document logic, making this a cross-client confidentiality breach. The same path also writes an external template ID to the attacker's report, and unauthorized access to authorization lines additionally allows reading lint results and overwriting the stored lint status for any template ID. This is the same data exposed in GHSA-hx63-6hvp-4rpv, accessed via paths not covered by the 7.1.1 fix. Remediation 21 June 2026: Reported via email 22 June 2026: Acceptance acknowledged with maintainers 24 June 2026: Fixed as part of v7.1.2 18 August 2026: Disclosed POC Code Prerequisites A Ghostwriter instance with at least two clients. Client B has a client-scoped report template (standard setup: each client has its own branded template). A non-privileged user (role ) assigned to a project under Client A, with at least one report they can edit. The user is not invited to or assigned to Client B. Steps 1. Confirm the attacker cannot access Client B's template via the controlled path (direct download) 2. Assign Client B's template to the attacker's report via the swap endpoint (no per-template authorization) Response (HTTP 200): The response also returns the detailed URL for the external template ( ). 3. Generate a DOCX for the attacker's report. The returned document is rendered from Client B's template. 4. The generated report contains Client B's confidential template content verbatim. The in the report attachment contains Client B's secret tags, confidentiality letterhead, and proprietary template, which the attacker is not authorized to view. Minor (Same category, lower impact) ( ) and ( ) do not override . only returns ( ), meaning any authenticated user can use any template ID (writing overwrites another client's stored and reading lint results for any template ID (variable names and Jinja errors leak the template structure)). Minor endpoints, no authorization, any authenticated user can read/write any template ID. Using the same session and victim template ID 5: Impact Any low-privilege user (role ) assigned to a single project can read the content of report templates belonging to other clients, breaking the client scoping intended to separate participating teams in multi-client deployments. Report templates typically contain client letterheads, logos, confidentiality statements, methodology wording, and report document logic, making this a cross-client confidentiality breach. The same path also writes an external template ID to the attacker's report, and unauthorized access to authorization lines additionally allows reading lint results and overwriting the stored lint status for any template ID. This is the same data exposed in GHSA-hx63-6hvp-4rpv, accessed via paths not covered by the 7.1.1 fix. Disclosure 21 June 2026: Reported via email 22 June 2026: Acceptance acknowledged with maintainers 24 June 2026: Fixed as part of v7.1.2 18 August 2026: Disclosed Fixed Version Ghostwriter 7.1.2 Summary: This release further locks down client-correlated report templates based on user feedback. It also includes a small bug fix to improve compatibility with older browsers. CHANGELOG [7.1.2] - 24 June 2026 Fixes Fixed rendering for whiteboard and decoration edit forms so that saved timestamps are reliably displayed in older browsers (closes #897) Security Fixed additional client-correlated report template authorization bypasses in template swap, report generation, archive generation, lint, and lint results endpoints - Report template selection now only accepts global templates or templates scoped to the client of the report's project - This fix inclu

Goal Reached Thanks to every supporter — we hit 100%!

Ghostwriter v7.1.1 Client Template Isolation Bypass leads to Data Leakage

More from this source