john-broadway pacioli up to 0.9.x pacioli-guard document-layer consent gate Document.cancel improper authorization

Summaryinfo

A vulnerability described as problematic has been identified in john-broadway pacioli up to 0.9.x. The impacted element is the function Document.cancel of the component pacioli-guard document-layer consent gate. Such manipulation leads to improper authorization. This vulnerability is traded as CVE-2026-107841. The attack may be launched remotely. There is no exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in john-broadway pacioli up to 0.9.x and classified as problematic. Affected by this issue is the function Document.cancel of the component pacioli-guard document-layer consent gate. The manipulation with an unknown input leads to a improper authorization vulnerability. Using CWE to declare the problem leads to CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. Impacted is integrity. CVE summarizes:

pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether the marker authorizes cancellation. A credential with API Key Scope.require_consent can submit a caller-controlled Sales Invoice or other supported document under a valid human-minted submit marker and reach Document.cancel() for a different pre-existing submitted document, bypassing the marker's document and act binding, single-use spend, and denial audit. The unauthorized cancellation can reverse the target document's ledger effect; principals without a consent-gated grant are not affected. This issue is fixed in version 0.10.0.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-107841 since 10/09/2026. The exploitation is known to be easy. The attack may be launched remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

Upgrading to version 0.10.0 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• john-broadway

Name

• pacioli

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9

Website

• Product: https://github.com/john-broadway/pacioli/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion