CyberRota Analysis
AI-GeneratedGhostwriter versions prior to 7.1.2 are vulnerable due to inadequate validation of template ownership in the report template swap endpoint, enabling attackers to exploit sequential template primary keys. This flaw allows unauthorized access to client-scoped templates, potentially exposing sensitive information such as letterhead and methodology text in generated reports. Organizations using Ghostwriter should prioritize patching to mitigate the risk of data leakage and unauthorized report generation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghostwriter before 7.1.2 fails to validate template ownership in the report template swap endpoint, allowing attackers to attach client-scoped templates from other clients to their own reports. Attackers can exploit sequential template primary keys to enumerate and attach foreign templates, then generate reports to disclose template contents including letterhead, boilerplate, and methodology text.