Description

Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored lint results provides an override, so each resolves a ReportTemplate from a caller-supplied primary key with no ownership or client-scope check. Any authenticated account can therefore lint an arbitrary template, which overwrites that template's stored lint result, and can read the returned findings, which enumerate the template's variable names and template-engine errors and so disclose its structure. This is distinct from the template swap path: that endpoint authorizes the report but omits the per-template check, whereas these endpoints omit authorization entirely and remain unfixed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-24T01:16:57.677Z",
  "pubdate": "2026-08-24T01:16:57.677Z",
  "executiveSummary": "An authorization bypass vulnerability exists in Ghostwriter through 7.2.6 within its report template lint endpoints, specifically lacking per-object access controls.\nThe vulnerability allows any authenticated account to execute arbitrary template linting operations and retrieve stored lint results without verifying ownership or client-scope boundaries.\nSuccessful exploitation results in the unauthorized disclosure of internal template structures, variable names, and template-engine error logs, alongside the ability to overwrite stored lint results for arbitrary templates.\nThe flaw stems from the improper implementation of the RoleBasedAccessControlMixin.test_func method, which defaults to validating only request.user.is_active without enforcing object-level permissions on the targeted ReportTemplate primary key.\nAttackers require a valid authenticated account within the system to trigger the vulnerable endpoints.\nThe risk implication involves information disclosure and integrity compromise of template linting data across tenant or user boundaries within multi-user deployments.",
  "technicalDetails": "The vulnerability resides in the report template linting endpoints of Ghostwriter through 7.2.6, which fail to enforce per-object authorization checks on resource identifiers supplied by callers.\nThe root cause is tied to the RoleBasedAccessControlMixin.test_func implementation, which evaluates exclusively to request.user.is_active unless explicitly overridden by a specific view.\nNeither the endpoint responsible for linting a report template nor the endpoint that retrieves stored lint results provides the necessary view override, bypassing client-scope and ownership verification entirely.\nConsequently, each affected endpoint resolves a ReportTemplate instance directly from a caller-supplied primary key without validating whether the authenticated user owns or is authorized to access that specific object.\nThe attack flow proceeds as follows: an authenticated attacker crafts an HTTP request targeting the report template lint endpoint or the stored lint results endpoint using an arbitrary ReportTemplate primary key belonging to another user or scope.\nDue to the absence of access controls, the application processes the request, allowing the attacker to lint an arbitrary template and overwrite its stored lint result.\nSubsequently, the attacker reads the returned findings, successfully enumerating internal variable names, template-engine errors, and structural details of the targeted template.\nThis vulnerability requires network exposure to the Ghostwriter application interface and assumes the attacker possesses a valid authenticated account with standard privileges, requiring no special administrative rights."
}