CVE-2026-78204: Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints
Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.testfunc returns only request.user.isactive unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored lint results provides an override, so each resolves a ReportTemplate from a caller-supplied primary key with no ownership or client-scope check. Any authenticated account can therefore lint an arbitrary template, which overwrites that template's stored lint result, and can read the returned findings, which enumerate the template's variable names and template-engine errors and so disclose its structure. This is distinct from the template swap path: that endpoint authorizes the report but omits the per-template check, whereas these endpoints omit authorization entirely and remain unfixed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ghostwriterto a version that resolves this vulnerability.Fixed in 7.2.6 - Configuration
Add per-template (ownership/client-scope) authorization checks to both the endpoint that lints a report template and the endpoint that returns stored lint results, since Ghostwriter through 7.2.6 does not apply per-object authorization on these endpoints.
Ghostwriter report template lint endpoints per-object authorization / ownership or client-scope check = required
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated active Ghostwriter account can exploit it. The attacker does not need ownership of the target report template or membership in its client scope, but must know or supply that template's primary key.
What can an attacker do through the affected endpoints?
They can trigger linting for an arbitrary report template, overwriting its stored lint result. They can also retrieve lint findings that disclose template variable names, template-engine errors, and aspects of the template's structure.
Are inactive or unauthenticated users affected?
The affected authorization mixin allows access based on request.user.is_active. The provided information supports exposure to authenticated active accounts; it does not establish access for unauthenticated or inactive users.
How can I determine whether an instance is affected?
Ghostwriter versions through 7.2.6 are affected. An instance is exposed if an active low-privilege account can use the report-template lint or stored lint-result endpoint with a primary key for a template it does not own or is not authorized to access.