Executive brief
Ghostwriter is a SpecterOps project management and reporting engine used to coordinate security assessments and generate client reports. An authenticated attacker can access any report template's structure and findings—including sensitive template variable names and template engine errors—without proper authorization, and can overwrite stored lint results on arbitrary templates belonging to other users or clients. This enables unauthorized information disclosure about organizational report structure.
Technical details
The vulnerability is an authorization bypass in the report template lint endpoints. The RoleBasedAccessControlMixin.test_func method defaults to checking only request.user.is_active and does not enforce per-object authorization unless explicitly overridden in a view. The lint endpoints that accept a caller-supplied ReportTemplate primary key and return lint results fail to override this check, allowing any authenticated user to resolve and access arbitrary templates without ownership or client-scope validation. An attacker can lint any template (overwriting its stored lint results) and read the returned findings, which disclose the template's internal structure through variable names and template-engine errors. The vulnerability stems from omitting authorization checks entirely, as opposed to other endpoints that authorize the parent report but fail to check per-template permissions. Patches are expected but not yet detailed in the advisory.
Affected products
- GhostManager Ghostwriter through 7.2.6
Timeline
- 2026-08-24: disclosed