CVE-2026-107841: pacioli-guard Document Consent Marker Bypass Vulnerability
Summary
CVE-2026-107841: pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents. Affects pacioli-guard versions >= 0.9.6, < 0.10.0. Fixed in 0.10.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
pacioli-guard is a Python package designed to enforce consent gating for document submissions and cancellations in ERPNext, a popular open-source ERP system. It requires a unique, document-bound consent marker to authorize actions that affect documents. This functionality is crucial for maintaining compliance and ensuring that sensitive operations are performed with explicit user consent.
Vulnerability Detail
The vulnerability arises from a flaw in the consent gating mechanism of pacioli-guard, where nested document actions can bypass the required consent marker. Specifically, when a document is submitted with an authorized consent marker, subsequent cancellations of related documents can occur without additional consent checks. This leads to unauthorized cancellations, potentially reversing financial transactions without user approval. The issue is rooted in the logic that allows 'riding' on the consent of the enclosing act, which fails to enforce proper act-binding checks.
How To Fix
Minimum fixed version
0.10.0
This is the first release that contains the fix.
pip install --upgrade "pacioli-guard==0.10.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to remove the 'require_consent' setting from affected grants in your application. This will disable the consent gating feature, but it is not a substitute for upgrading to the patched version. Additionally, you can restrict the scope of governed credentials to prevent them from submitting documents that could lead to unauthorized cancellations.
Conclusion
CVE-2026-107841 is a significant vulnerability in the pacioli-guard package that allows unauthorized document cancellations due to a flaw in the consent gating mechanism. Upgrading to version 0.10.0 or later is essential to mitigate this risk. Users should also consider using Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for pacioli-guard →
FAQ
The vulnerability allows unauthorized cancellations of documents, potentially reversing financial transactions without user consent.
Only sites that have opted into consent gating with the 'require_consent' setting enabled are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
The CVSS score for this vulnerability is 5.7, indicating a moderate severity level.
As a temporary measure, you can remove the 'require_consent' setting from affected grants or restrict the scope of governed credentials.
