Threats tagged 'ghsa-3hj7-6vmj-h8v4'

CVE-2026-107841 is an incorrect authorization vulnerability in the john-broadway pacioli package version 0.9.6. It allows an attacker with a credential having API Key Scope 'require_consent' to cancel documents without proper consent markers due to a flaw in the consent gate logic. This enables cancellation of submitted documents that a human operator never approved, reversing ledger effects. The issue is fixed in version 0.10.0, which enforces act-bound consent markers for cascading cancels. Only sites that opted into consent gating are affected.