CVE-2026-78204: Missing Authorization in GhostManager Ghostwriter

Ghostwriter through version 7.2.6 does not enforce per-object authorization on its report template lint endpoints. The RoleBasedAccessControlMixin.test_func method only checks if the user is active, and these endpoints do not override this behavior to enforce ownership or client-scope restrictions. Consequently, any authenticated user can supply a primary key to lint an arbitrary report template, overwrite its stored lint result, and access lint findings that disclose variable names and template-engine errors, revealing the template's internal structure. This vulnerability differs from the template swap endpoint issue, which authorizes the report but omits per-template checks; here, authorization is entirely missing on the lint endpoints and remains unpatched.

Any authenticated user can lint arbitrary report templates without proper authorization, potentially overwriting lint results and accessing sensitive information about template structure, including variable names and template-engine errors. This could lead to information disclosure about report templates but does not allow direct modification of the templates themselves.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user access to the report template lint endpoints or implement custom authorization checks to enforce ownership or client-scope restrictions on these endpoints.