Auth bypass in John-Broadway Pacioli
CVE-2026-107841
pacioli provides least-privilege governance and a governed agent broker for ERPNext. From version 0.9.6 until version 0.10.0, the pacioli-guard document-layer consent gate allows nested cancellation operations to ride any consent established by an enclosing governed act without checking whether the marker authorizes cancellation. A credential with API Key Scope.require_consent can submit a caller-controlled Sales Invoice or other supported document under a valid human-minted submit marker and reach Document.cancel() for a different pre-existing submitted document, bypassing the marker's document and act binding, single-use spend, and denial audit. The unauthorized cancellation can reverse the target document's ledger effect; principals without a consent-gated grant are not affected. This issue is fixed in version 0.10.0.
Vulnerability class: Broken Access Control
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.7 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- John-Broadway Pacioli — versions >= 0.9.6, < 0.10.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-107841?
- CVE-2026-107841 is a medium-severity vulnerability in John-Broadway Pacioli, classified under Incorrect Authorization. CVSS score: 5.7/10. Published 2026-10-09.
- How severe is CVE-2026-107841?
- Medium severity. CVSS v3 base score is 5.7 out of 10.