Ghostwriter through 7.2.6 contains an authorization bypass in its template lint endpoints that stems from a fundamental design flaw in the framework's RBAC architecture. The issue is not that someone introduced a bug—it is that the authorization mixin used across the codebase has a permissive default that passes authorization for any active user. When developers inherit this mixin in new views without explicitly overriding the authorization check, the result is a silent security regression: the code functions correctly, tests pass, and the endpoint appears protected because the mixin implies security exists.
The template swap endpoint received a partial fix that adds a report-level authorization check—but no template-scope check. The lint endpoints received no fix at all. This inconsistency is the analytical signal: the partial fix was scoped to the reported attack vector rather than auditing the broader authorization pattern. If you are running Ghostwriter, assume every endpoint that resolves a ReportTemplate from a caller-supplied primary key is affected until proven otherwise. The information disclosure is the more serious concern here. Template variable names, engine error messages, and template structure are not internal implementation details—they are reconnaissance data that reveals the API surface operators use to document structures. An attacker who can enumerate templates gains a map for subsequent injection or manipulation attacks against whatever those templates produce. The CVSS 5.4 rating captures the technical severity of information disclosure but not the strategic intelligence value: this is the reconnaissance phase of a targeted attack, not the exploit itself.
Audit your deployment for views inheriting the authorization mixin without explicit overrides. Treat the partial fix on template swap as evidence that other endpoints in the same family were not reviewed. The mixin's permissive default means 'no override' is ambiguous—it could mean 'we considered this safe' or 'we forgot to think about it,' and you cannot distinguish the two from the code alone.