EUVD-2026-64678
GHSA-r3hm-6h2p-vf9v
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible endpoint, low complexity, requires authenticated low-privilege user; high confidentiality loss from template disclosure, minor integrity from unauthorized template attachment, no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.
AnalysisAI
Cross-client template disclosure in Ghostwriter before 7.1.2 allows authenticated users to exfiltrate proprietary report templates belonging to other clients managed within the same platform instance. The report template swap endpoint failed to enforce ownership validation, accepting user-controlled template primary keys without verifying client-scope alignment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated Ghostwriter user account (PR:L), confirming that unauthenticated access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N) is well-calibrated: the network vector with low complexity and low privilege requirements reflects that any authenticated platform user can exploit this with a trivial integer enumeration - no special tooling or chaining required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated red team consultant or low-privilege Ghostwriter user on a managed multi-tenant instance iterates integer values in the template swap API request, substituting their own report's template ID with incrementing integers. When a foreign client-scoped template ID is matched, the endpoint silently accepts it; the attacker then triggers report generation, which renders the foreign template and discloses that client's proprietary letterhead, legal disclaimers, and methodology text. … |
| Remediation | Upgrade Ghostwriter to version 7.1.2 or later, which introduces client-scope enforcement on template assignment via the `can_apply_to_report()` method and restricts GraphQL mutations on template ID columns. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Ghostwriter deployments and their current versions to determine exposure scope. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Ghostwriter
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today