The vulnerability resides in Ghostwriter’s report template lint endpoints, which omit per-object authorization. When a user supplies a report template ID, the system retrieves the template without verifying ownership or client scope. An authenticated user can therefore lint any template, overwriting its stored lint result and retrieving findings that expose the template’s variable names and engine errors. This allows unauthorized disclosure of internal template structure and potential tampering with lint data.

GhostManager’s Ghostwriter application through version 7.2.6 is affected. All releases up to and including 7.2.6 expose the lint endpoints without proper authorization. The issue is present in the code paths that lint a report template and that return stored lint results, both lacking ownership checks.

The CVSS score of 5.3 indicates moderate impact. The vulnerability is exploitable by any authenticated user, with no privilege escalation required. An attacker only needs to know or guess a valid template primary key to trigger the content modification or disclosure. Because the EPSS score is not available and it is not listed in CISA KEV, the known exploitation activity is unclear, yet the straightforward attack route and lack of safeguards make it a notable concern for organizations using the affected Ghostwriter version.