ERPNext pacoli-guard Consent Bypass in Document Cancel Logic

Vulnerability Overview Title: Cancellation of caller-named pre-existing documents via submit consent marker bypass Description: Impact: The document layer consent gating in requires a human-generated, single-use, document-bound, and action-bound token. Because performs further document writes as a result of controlled actions, nested actions allow "hiding" the consent established by the outer action. This results in any operation executed within an action where consent has already been established not requiring a token, lacking action binding checks, lacking single-use consumption, and lacking audit logs for rejection. Specific Implementation: This vulnerability can be triggered via precise operations, such as and . Scope Affected Versions: (pip) >= 0.9.6, < 0.10.0 Fixed Version: 0.10.0 Affected Organizations: Only those organizations that have opted into consent gating, i.e., credentials must hold . is ineffective for credentials without this grant, and credential scope floors ( ) are not affected by this issue. Mitigation Patch: In version 0.10.0, actions can now cascade to further reversals; however, a submit does not cascade to the cancellation of pre-existing documents, as this is a scenario where consent can and should be required. The consent marker carries the state established at the time of document creation, rather than being a simple boolean value as in the vulnerable code state. Behavioral Change Upon Upgrade: Any workflow where a submit cascades into a lifecycle cancellation now requires a consent marker to cancel both itself and the underlying document. In , this includes Asset Sale, Partial Quantity Asset Sale, Credit Notes, Asset Sales, Asset Repair Capitalization, Asset Transfer Allocation, Asset Value Adjustment, and . To facilitate this, the header now accepts multiple tokens separated by spaces or commas; each token is bound to a specific document and action, requires a distinct minting, and is consumed exactly once. Workaround For version 0.9.6, remove from controlled grants and rely on credential scope floors, or scoped credentials such that they cannot submit documents whose controllers can cancel other documents (for the use case, with populated item rows containing is a known path). This serves as a preliminary alternative. Residuals and Statements Cascading cancellations of pre-existing documents under controlled cancellations remain effective. This is a load-bearing cancellation (standard asset cancellation causes to cancel credit/debt notes and generate journals via ), and it cannot be narrowed down without a signal indicating that the cascading cancellation is part of the controlled document's cancellation. As a result of this fix, at least one caller-driven instance has been addressed within the same patch. ( ) cancels and entries, which are populated in a child table by the caller. also does not detect or skips the document lifecycle entirely (e.g., or direct field writes via ); these residuals are documented within the project's own sources and are not impacted by this advisory. Credits Discovered via internal adversarial review on 2026-07-28, tracing predicates in the and source code, rather than relying on project documentation. Previous code comments claimed no such lever was known; this assertion was made without corresponding source code scanning. Code Block

Goal Reached Thanks to every supporter — we hit 100%!

ERPNext pacoli-guard Consent Bypass in Document Cancel Logic

More from this source