Ghostwriter Authorization Bypass Vulnerabilities

Cross-client template disclosure in Ghostwriter before 7.1.2 allows authenticated users to exfiltrate proprietary report templates belonging to other clients managed within the same platform instance. The report template swap endpoint failed to enforce ownership validation, accepting user-controlled template primary keys without verifying client-scope alignment. Because template PKs are sequential integers, an attacker with any authenticated access can enumerate foreign template IDs, attach them to their own reports, and trigger report generation to read sensitive client deliverable content - including letterhead, boilerplate legal text, and pentest methodology. No public exploit identified at time of analysis, though VulnCheck has published an advisory and a researcher (geo-chen) has documented the issue in a public repository.

Missing per-object authorization on Ghostwriter's report template lint endpoints through version 7.2.6 exposes cross-tenant template metadata to any authenticated user. The RoleBasedAccessControlMixin.test_func method defaults to checking only request.user.is_active, and neither the lint-trigger endpoint nor the lint-result retrieval endpoint overrides this with ownership or client-scope validation. Any holder of a valid active account can lint an arbitrary template by supplying its primary key, overwriting that template's stored lint result and reading returned findings that enumerate variable names and template-engine errors - disclosing template structure across organizational boundaries. No public exploit confirmed at time of analysis, though a public researcher writeup exists.