Authorization Flaw in pacioli-guard (CVE-2026-107841)
Summary
Vulnerability in pacioli-guard (CVE-2026-107841). Data can be tampered with by attackers. Exploitable via true. Mitigation: upgrade to 0.10.0 or later.
Original description
The description as published by the source.
Impact
pacioli-guard's document-layer consent gate requires a human-minted, single-use, document-bound and act-bound marker before a credential carrying API Key Scope.require_consent may submit or cancel a document. Because ERPNext performs further document writes as a consequence of a governed act, nested acts are allowed to "ride" the consent established by the enclosing act instead of needing a marker of their own.
The ride predicate returned true for every cancel, regardless of which act the enclosing marker authorised. Riding never reaches consent_verdict, which is where the marker-to-act binding is enforced. The result: any Document.cancel() performed inside an act that had established consent reached docstatus = 2 with no marker, no act-binding check, no single-use spend, and no denial audit row.
This is reachable with the exact grant an operator is documented to give the broker, and the cancelled document's identity is caller-controlled:
Sales Invoice.on_submit(sales_invoice.py:507) callsprocess_asset_depreciation()unconditionally, reachingdepreciate_asset_on_sale(:1508-1516).- That iterates the invoice's item rows and calls
frappe.get_doc("Asset", d.asset).Sales Invoice Item.assetis a plain writableLinkwith noread_onlyand nofetch_from, so the caller supplies it in the request body. The validation that would constrain it sits behindif d.is_fixed_asset:(:428-429), a server-set field. - The chain r…
Source: NIST National Vulnerability Database NVD GitHub Advisory
Auto-generated summary
Assembled by SecPulse from the source data (CVSS, CWE, affected versions) using templates — no AI involved. Check the original description and references below for exact details.
A vulnerability tracked as CVE-2026-107841 has been found in pacioli-guard.
Attackers can target a specific entry point like true over the network to misuse the product.
Data can be tampered with by attackers. CVSS score: 5.7/10.
What to do: upgrade pacioli-guard to 0.10.0 or later.
If unsure, ask your IT team or search "pacioli-guard CVE-2026-107841" on the vendor's site.
CVE-2026-107841 (pacioli-guard) — CWE-863 / CVSS v3 5.7
Attack vector: remote (network-reachable)
Attack surface: true / consent_verdict / depreciate_asset_on_sale / Link
Patched: 0.10.0 — apply immediately
Workaround: On 0.9.6, remove require_consent from affected grants and rely on the credential-scoping floor alone, or scope governed credentials so they cannot submit documents whose controllers cancel other documents (for ERPNext slice-one, Sales Invoice wit
Plan: 1) Audit SBOM/dependencies, 2) Stage→prod upgrade, 3) Add WAF/proxy monitoring on affected endpoints, 4) Hunt IOCs in logs.
Refs: see the GHSA / vendor advisory / patched release linked on this page.
Incorrect authorization (CWE-863) exists in pacioli-guard. Attackers reach the vulnerable code path via true.
Check the vendor advisory for the affected versions of pacioli-guard. Attack surface: true / consent_verdict / depreciate_asset_on_sale / Link.
Severity: Medium (CVSS 5.7/10). Data can be tampered with by attackers.
Update to 0.10.0.
Workaround: On 0.9.6, remove require_consent from affected grants and rely on the credential-scoping floor alone, or scope governed credentials so they cannot submit documents whose controllers cancel other documents (for ERPNext slice-one, Sales Invoice wit
Search webserver/proxy logs for unusual request patterns matching this CVE's known IOCs. Run grep -r 'pacioli-guard' . against your dependency files (package-lock.json, requirements.txt, go.sum) to find affected services.
Response actions
Concrete steps and command examples for SOC/SRE teams to execute in order
-
1Identify exposure identify
grep -r 'pacioli-guard' . | grep -v node_modulesリポジトリと本番環境の依存ファイル (package-lock.json / requirements.txt / go.sum / Gemfile.lock 等) で
pacioli-guardを grep し、稼働しているサービス・バージョンを把握する。 -
2Apply temporary workaround mitigate
On 0.9.6, remove `require_consent` from affected grants and rely on the credential-scoping floor alone, or scope governed credentials so they cannot submit documents whose controllers cancel other documents (for ERPNext slice-one, `Sales Invoice` witパッチが適用されるまでの応急処置として、On 0.9.6, remove
require_consentfrom affected grants and rely on the credential-scoping floor alone, or scope governed credentials so they cannot submit documents whose controllers cancel other documents (for ERPNext slice-one,Sales Invoicewit を実施。回避策の副作用 (機能低下) を確認した上で。 -
3Apply patch patch
Upgrade pacioli-guard to 0.10.0ステージング環境で 0.10.0 に上げて回帰テスト → 本番反映。回帰テストはアプリの主要ハッピーパスを含めること。
-
4Post-deployment verification verify
Confirm patched version is live in productionパッチ適用後、ステージングで PoC または同等の悪用パターンを再現して脆弱性が閉じたことを確認。本番ではアクセスログ・WAF でアラート再発が無いか継続監視。
Affected packages
References
- advisory nvd.nist.gov
- advisory github.com
- package github.com
- package pypi.org
- web github.com
- web github.com
- web github.com