CVE-2026-78204 | CVSS: 5.4 | 严重级别: MEDIUM
Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that lints a report template nor the endpoint that returns stored lint results provides an override, so each resolves a ReportTemplate from a caller-supplied primary key with no ownership or client-scope check. Any authenticated account can therefore lint an arbitrary template, which overwrites that template's stored lint result, and can read the returned findings,
参考链接:
• https://github.com/GhostManager/Ghostwriter
• https://github.com/GhostManager/Ghostwriter/blob/v7.2.6/ghostwriter/api/utils.py
• https://github.com/geo-chen/oss/blob/main/Ghostwriter.md
📌 数据来源: NVD 官方