CVE-2026-78204 debrief: Ghostwriter 7.2.6 report template lint endpoints lack per-object authorization, allowing any authenticated user to lint and read arbitrary templates, disclosing template structure. This vulnerability highlights the need for defenders to verify exposure and implement per-object authorization to prevent unauthorized access to report templates. The affected product, Ghostwriter, is a [truncated]
CVE-2026-78203 is a vulnerability in Ghostwriter before version 7.1.2, where an attacker can exploit the report template swap endpoint to attach client-scoped templates from other clients to their own reports, potentially disclosing template contents including letterhead, boilerplate, and methodology text. This vulnerability allows attackers to enumerate and attach foreign templates using sequential templ [truncated]
