CVE-2026-78203

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-78203
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78203.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-78203
Published
2026-08-24T00:30:44.452Z
Modified
2026-08-25T04:02:34.087413907Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Ghostwriter before 7.1.2 Cross-Client Report Template Disclosure via Unauthorized Template Swap
Details

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/78xxx/CVE-2026-78203.json",
    "cwe_ids": [
        "CWE-639"
    ],
    "cna_assigner": "VulnCheck"
}
References

Affected packages

Git / github.com/ghostmanager/ghostwriter

Affected ranges

Type
GIT
Repo
https://github.com/ghostmanager/ghostwriter
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
7ceb558c3f26ebd61a0e816a55e24677939b3fa9
Fixed
5b2a4a297e44c823c16f65b1ba101c742791cd0b
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "7.1.2"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.2-rc1
v2.*
v2.0.0.0
v2.1
v2.1.1
v2.2.0
v2.2.1
v2.2.2
v2.2.2-rc1
v2.2.2-rc2
v2.2.3
v2.2.3-rc1
v2.2.3-rc2
v2.3.0-rc1
v2.3.0-rc2
v3.*
v3.0.0
v3.0.0-rc1
v3.0.3
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.03
v3.1.4
v3.1.5
v3.2.0
v3.2.1
v3.2.10
v3.2.11
v3.2.12
v3.2.2
v3.2.3
v3.2.4
v3.2.5
v3.2.6
v3.2.7
v3.2.8
v3.2.9
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.1.0
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.3.0
v4.3.1
v4.3.10
v4.3.11
v4.3.2
v4.3.3
v4.3.4
v4.3.5
v4.3.6
v4.3.7
v4.3.8
v4.3.9
v5.*
v5.0.0
v5.0.1
v5.0.10
v5.0.11
v5.0.12
v5.0.2
v5.0.3
v5.0.4
v5.0.5
v5.0.6
v5.0.7
v5.0.8
v5.0.9
v6.*
v6.0.0
v6.0.2
v6.0.3
v6.0.4
v6.0.6
v6.1.0
v6.1.1
v6.2.0
v6.2.1
v6.2.10
v6.2.11
v6.2.12
v6.2.13
v6.2.2
v6.2.3
v6.2.4
v6.2.5
v6.2.6
v6.2.7
v6.2.8
v6.2.9
v6.3.0
v6.3.0-rc2
v6.3.1
v6.3.2
v6.3.3
v6.3.4
v6.3.5
v6.3.6
v7.*
v7.0.0
v7.0.1
v7.0.2
v7.1.0
v7.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-78203.json"