CVE-2026-107841: pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

pacioli-guard’s document-layer consent gate requires a human-minted, single-use, document-bound and act-bound marker before a credential carrying API Key Scope.require_consent may submit or cancel a document. Because ERPNext performs further document writes as a consequence of a governed act, nested acts are allowed to “ride” the consent established by the enclosing act instead of needing a marker of their own.

The ride predicate returned true for every cancel, regardless of which act the enclosing marker authorised. Riding never reaches consent_verdict, which is where the marker-to-act binding is enforced. The result: any Document.cancel() performed inside an act that had established consent reached docstatus = 2 with no marker, no act-binding check, no single-use spend, and no denial audit row.

This is reachable with the exact grant an operator is documented to give the broker, and the cancelled document’s identity is caller-controlled:

• Sales Invoice.on_submit (sales_invoice.py:507) calls process_asset_depreciation() unconditionally, reaching depreciate_asset_on_sale (:1508-1516).
• That iterates the invoice’s item rows and calls frappe.get_doc("Asset", d.asset). Sales Invoice Item.asset is a plain writable Link with no read_only and no fetch_from, so the caller supplies it in the request body. The validation that would constrain it sits behind if d.is_fixed_asset: (:428-429), a server-set field.
• The chain reaches depreciation.py:481 and then asset_depreciation_schedule.py:215-217, which calls current_schedule.cancel() on a docstatus == 1, submittable Asset Depreciation Schedule through the document lifecycle (only should_not_cancel_depreciation_entries is set, not ignore_validate, so before_cancel does fire and the ride is what admitted it).

So one marker authorising submit Sales Invoice X cancelled a submitted document the human was never shown and never approved. Cancelling such a document reverses its ledger effect.

The same shape exists behind wider grants, for example Unreconcile Payment.on_submit (unreconcile_payment.py:59-64), which walks a child table the caller fills and reaches accounts/utils.py:857/:859 gain_loss_je.cancel() on submitted Journal Entries.