GhostManager vulnerabilities

Products

• Ghostwriter 2

Latest GhostManager CVEs

Newest publication first

1. CVE-2026-78204 Ghostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints

   Published 2026-08-24

   Medium·CVSS 5.3

   Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint th...

2. CVE-2026-78203 Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap

   Published 2026-08-24

   High·CVSS 7.1

   Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.