Ghostwriter EUVD-2026-64678

Exploitation requires a valid authenticated Ghostwriter user account (PR:L), confirming that unauthenticated access is not sufficient. The attack is only impactful in multi-tenant deployments where at least two different clients have client-scoped templates stored on the same Ghostwriter instance - a single-client deployment exposes no foreign data. The integer sequential primary key enumeration requires no prior knowledge of other clients' template IDs. There is no special configuration required beyond the default template management workflow; the vulnerable endpoint is present in any standard Ghostwriter deployment running a version prior to 7.1.2. The key limiting factor is the authentication requirement and the need for a multi-tenant instance - operators running single-client instances face no cross-client confidentiality risk from this vector.

CVSS 4.0 base score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N) is well-calibrated: the network vector with low complexity and low privilege requirements reflects that any authenticated platform user can exploit this with a trivial integer enumeration - no special tooling or chaining required. The high confidentiality impact is appropriate given that exposed template contents (client letterhead, legal boilerplate, bespoke methodology) represent confidential business information. The low integrity impact reflects the ability to pollute a report with a foreign template, though this is secondary. The absence from CISA KEV and lack of confirmed POC code reduces urgency slightly, but the ease of exploitation (sequential PKs, no access complexity) means any multi-tenant Ghostwriter deployment where different competing clients exist on the same instance carries material business risk. Risk is highest for managed security service providers hosting multiple clients on a shared instance.

An authenticated red team consultant or low-privilege Ghostwriter user on a managed multi-tenant instance iterates integer values in the template swap API request, substituting their own report's template ID with incrementing integers. When a foreign client-scoped template ID is matched, the endpoint silently accepts it; the attacker then triggers report generation, which renders the foreign template and discloses that client's proprietary letterhead, legal disclaimers, and methodology text. No exploit code is required beyond a basic HTTP client capable of modifying POST parameters.