An authenticated attacker can exploit the predictable, sequential primary keys used to identify templates within the database. By iteratively manipulating these identifiers in requests to the swap endpoint, an attacker can associate templates belonging to other clients with their own report projects. Once the unauthorized template is attached, the attacker can trigger the report generation process to disclose sensitive contents, including corporate letterheads, proprietary boilerplate text, and specific project methodologies. This vulnerability poses a significant risk to organizations that store sensitive reporting artifacts within the Ghostwriter environment.

Attack Chain

1. The attacker authenticates to the Ghostwriter application as a standard user.
2. The attacker identifies the report template swap endpoint within the application's reporting module.
3. The attacker observes the template ID parameter being passed in the HTTP request to the swap endpoint.
4. The attacker enumerates sequential integers for the template ID parameter to identify IDs belonging to other clients.
5. The attacker sends a crafted POST request to the swap endpoint containing a foreign template ID, bypassing the intended ownership validation.
6. The application incorrectly associates the foreign template with the attacker's project, confirming the bypass.
7. The attacker invokes the report generation functionality to export the report incorporating the foreign template.
8. The final report is retrieved, disclosing the contents of the unauthorized client's template.

Impact

Successful exploitation results in the unauthorized disclosure of sensitive client information stored within report templates. This includes sensitive boilerplate text, confidential methodology, and visual assets like corporate letterheads. Given the nature of Ghostwriter as a security reporting platform, this impact could lead to the exposure of highly sensitive project details across multiple clients, potentially undermining the integrity and confidentiality of the victim organization's security engagements.

Recommendation

• Upgrade all instances of Ghostwriter to version 7.1.2 or later to remediate the vulnerability (CVE-2026-78203).
• Review audit logs for the reporting module to identify any anomalous template swapping activity where the requesting user does not match the template owner.
• Audit existing template configurations to ensure that sensitive methodologies or boilerplate content are not being improperly exposed to users with insufficient privileges.