CVE-2026-107841

pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

pacioli-guard's document-layer consent gate requires a human-minted, single-use, document-bound and act-bound marker before a credential carrying API Key Scope.require_consent may submit or cancel a document. Because ERPNext performs further document writes as a consequence of a governed act, nested acts are allowed to "ride" the consent established by the enclosing act instead of needing a marker of their own.

The ride predicate returned true for every cancel, regardless of which act the enclosing marker authorised. Riding never reaches consent_verdict, which is where the marker-to-act binding is enforced. The result: any Document.cancel() performed inside an act that had established consent reached docstatus = 2 with no marker, no act-binding check, no single-use spend, and no denial audit row.

This is reachable with the exact grant an operator is documented to give the broker, and the cancelled document's identity is caller-controlled:

• Sales Invoice.on_submit (sales_invoice.py:507) calls process_asset_depreciation() unconditionally, reaching depreciate_asset_on_sale (:1508-1516).
• That iterates the invoice's item rows and calls frappe.get_doc("Asset", d.asset). Sales Invoice Item.asset is a plain writable Link with no read_only and no fetch_from, so the caller supplies it in the request body. The validation that would constrain it sits behind if d.is_fixed_asset: (:428-429), a server-set field.
• The chain reaches depreciation.py:481 and then asset_depreciation_schedule.py:215-217, which calls current_schedule.cancel() on a docstatus == 1, submittable Asset Depreciation Schedule through the document lifecycle (only should_not_cancel_depreciation_entries is set, not ignore_validate, so before_cancel does fire and the ride is what admitted it).

So one marker authorising submit Sales Invoice X cancelled a submitted document the human was never shown and never approved. Cancelling such a document reverses its ledger effect.

The same shape exists behind wider grants, for example Unreconcile Payment.on_submit (unreconcile_payment.py:59-64), which walks a child table the caller fills and reaches accounts/utils.py:857/:859 gain_loss_je.cancel() on submitted Journal Entries.

The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions. Typical impact: unauthorized data access or execution of privileged operations.

CVE-2026-107841 has a CVSS score of 5.7 (Medium). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (0.10.0); upgrading removes the vulnerable code path.

Kodem intelligence

Already deployed Kodem?

Fixed in 0.10.0. The ride now discriminates on the enclosing act: an undo may cascade into further undos, but a submit may not cascade into the cancellation of a document that already has a name, because that is an act a human could have been asked to approve. The custody stamp carries the act it was established for rather than a bare boolean, which is the state the vulnerable code lacked.

Upgrading changes behavior. Any ERPNext flow where a submit cascades into a lifecycle cancel now requires a consent marker for that cancel as well as for the act itself. In ERPNext v16 that includes asset sale, partial-quantity asset sale, a credit note against an asset sale, Asset Repair capitalization, Asset Shift Allocation, Asset Value Adjustment, and Unreconcile Payment. To make that possible, the X-Pacioli-Consent header now accepts several markers separated by whitespace or commas; each remains bound to one document and one act, requires a different minter, and is spent exactly once.

1. What is CVE-2026-107841? CVE-2026-107841 is a medium-severity incorrect authorization vulnerability in pacioli-guard (pip), affecting versions >= 0.9.6, < 0.10.0. It is fixed in 0.10.0. The application does not correctly enforce access controls, allowing a principal to access resources or operations beyond their granted permissions.
2. How severe is CVE-2026-107841? CVE-2026-107841 has a CVSS score of 5.7 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of pacioli-guard are affected by CVE-2026-107841? pacioli-guard (pip) versions >= 0.9.6, < 0.10.0 is affected.
4. Is there a fix for CVE-2026-107841? Yes. CVE-2026-107841 is fixed in 0.10.0. Upgrade to this version or later.
5. Is CVE-2026-107841 exploitable, and should I be worried? Whether CVE-2026-107841 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-107841 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-107841? Upgrade pacioli-guard to 0.10.0 or later.