Template Ownership Validation Failure Enables Cross-Client Disclosure

Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

Ghostwriter versions before 7.1.2 contain a critical authorization flaw in the report template swap endpoint that fails to validate template ownership before attachment. This vulnerability allows attackers to enumerate templates belonging to other clients by exploiting sequential primary keys, then attach foreign templates to their own reports and generate them to extract sensitive contents—including letterhead, boilerplate text, and methodology documentation. Organizations using Ghostwriter for client-facing security reporting are at risk of inadvertent disclosure of confidential information across client boundaries, potentially exposing methodologies, branding, and internal processes. The high CVSS score of 7.1 reflects the ease of exploitation and significant impact on confidentiality.

Casky's 283 matched security skills leverage Claude AI with extended reasoning to correlate this vulnerability against MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify attack patterns including: unauthorized API calls to template endpoints lacking ownership checks (privilege escalation via broken access control), sequential enumeration of template identifiers indicating information disclosure reconnaissance, and anomalous report generation requests that reference templates outside the attacker's client scope. The extended reasoning engine would flag unusual template ID patterns in request logs, cross-reference them against access control matrices, and surface findings showing how attackers leverage authorization bypass to transition from enumeration to data exfiltration—enabling detection before sensitive template contents are compromised.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-78203.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-78203

Casky has 283 skills that investigate the attack patterns behind CVE-2026-78203. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn