Ghostwriter EUVD-2026-64679

Authentication is required - the attacker must hold any active Ghostwriter user account (CVSS PR:L confirms low-privilege authentication is sufficient; unauthenticated access is not possible). No elevated role, administrative privileges, or non-default configuration is needed beyond account activation via request.user.is_active. Exploitation targets the report template lint trigger endpoint and the stored lint result retrieval endpoint, both of which accept a caller-supplied template primary key integer with no ownership validation. The attack is bounded to template metadata disclosure (variable names, template-engine errors) and stored lint result overwriting - it does not provide access to full report content, authentication credentials, or report data beyond the lint output. Exploitation is further limited to deployments where untrusted or low-privilege users hold active accounts alongside sensitive templates belonging to other clients.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N) confirms low-complexity network exploitation requiring only a valid authenticated session - no elevated role or special configuration needed. Both confidentiality and integrity impacts are low, scoped to template structure metadata disclosure and lint result overwrites rather than full report content or account takeover. No CISA KEV listing is present, and no confirmed active exploitation has been identified at time of analysis. However, a public researcher writeup at geo-chen/oss exists and is cited in the VulnCheck advisory, materially lowering the exploitation barrier for any account holder who finds the disclosure. Risk is most significant in multi-tenant Ghostwriter deployments where client-scope isolation is a security expectation - any team managing sensitive red team engagements for multiple clients should treat cross-tenant template enumeration as a meaningful confidentiality breach. EPSS score data was not provided in the available intelligence.

An authenticated Ghostwriter user with any active low-privileged account iterates through sequential or guessed report template primary keys by calling the lint trigger endpoint with each ID. The endpoint resolves the template object and executes linting with no ownership check, returning findings that enumerate variable names and template-engine errors belonging to templates across all clients and users. A public researcher writeup documenting this behavior exists, providing a practical reference for exploitation.