pacioli-guard EUVD-2026-95937

Exploitation requires an authenticated credential holding an API Key with Scope.require_consent (a consent-gated grant) and a valid, human-minted submit marker from an enclosing governed act to ride; the attacker submits a caller-controlled Sales Invoice or other supported document and nests a cancel targeting a different pre-existing submitted document. Limiting factors: principals that have no consent-gated grant are explicitly not affected; a legitimate human must first mint the submit marker (UI:R), the attacker must already possess valid API credentials (PR:L), and only pacioli-guard versions 0.9.6 through just before 0.10.0 are vulnerable - 0.10.0 fixes the marker's document and act binding.

This is a medium-severity (CVSS 5.7) authorization flaw (CWE-863) whose signals are internally consistent and point to a limited, non-urgent priority. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R confirms a network-reachable issue but with two real brakes: the attacker needs a valid authenticated credential (PR:L - specifically an API Key with Scope.require_consent) and must ride a legitimately human-minted submit marker (UI:R), so exploitation cannot proceed against a target with no outstanding consent-gated grant. Impact is integrity-only (C:N/I:H/A:N): the attacker can cancel a pre-existing submitted document and reverse its ledger effect, but cannot read data or deny service. No EPSS score, KEV listing, or public exploit was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation; these absences are expected for an obscure product rather than reassuring. Net: a genuine authorization bypass worth patching for the small population that runs pacioli-guard with consent-gated grants, but not a widespread or wormable threat. The signals do not conflict - the moderate CVSS, the PR:L/UI:R preconditions, and the lack of exploitation telemetry all align on 'targeted, low-volume risk.'

An insider or compromised-but-legitimate automation account holding an API Key with Scope.require_consent submits a caller-controlled Sales Invoice (or other supported DocType) under a valid human-approved submit marker, then nests a cancel operation inside that governed act. Because the consent gate does not verify that the marker authorizes cancellation, the nested call reaches Document.cancel() against a different, pre-existing submitted document and reverses its ledger entry. No public exploit code is known, but the attack requires no special tooling - only an existing consent-gated credential and an in-flight submit marker to ride.