CVE-2026-78204 describes a missing authorization vulnerability in Ghostwriter through version 7.2.6 affecting the report template lint endpoints. The RoleBasedAccessControlMixin.test_func method returns only request.user.is_active unless overridden, but the lint and lint result endpoints do not override it. Consequently, any authenticated user can supply a primary key to access and lint arbitrary report templates without ownership or client-scope validation. This allows overwriting the stored lint result and reading lint findings, which disclose variable names and template-engine errors, revealing the internal structure of the templates. This vulnerability differs from the template swap endpoint issue, which authorizes the report but omits per-template checks, whereas these lint endpoints omit authorization entirely and remain unfixed.

Any authenticated user can lint arbitrary report templates without proper authorization, enabling them to overwrite stored lint results and access lint findings that disclose sensitive template structure information. This could lead to information disclosure about report templates that might be leveraged in further attacks or reconnaissance. The vulnerability does not allow unauthenticated access but requires at least an active authenticated account.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the report template lint endpoints to trusted users only and monitor for unusual activity involving these endpoints. Do not rely on the current authorization mechanism as it does not enforce ownership or client-scope checks on these endpoints.