CVE-2026-78203 is an authorization bypass vulnerability in Ghostwriter prior to version 7.1.2. The vulnerability arises because the application fails to validate template ownership in the report template swap endpoint. Attackers can exploit sequential template primary keys to enumerate and attach templates scoped to other clients to their own reports. This enables unauthorized disclosure of template contents including letterhead, boilerplate, and methodology text. The CVSS 4.0 base score is 7.1, indicating a high severity issue with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality.

An attacker with limited privileges can enumerate and attach report templates from other clients, leading to unauthorized disclosure of sensitive template contents. This may expose proprietary or confidential information embedded in report templates, such as letterhead and methodology details. There is no indication of privilege escalation or code execution, but confidentiality impact is high.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict access to the report template swap endpoint to trusted users only and monitor for suspicious activity involving template enumeration or swapping.