Executive assessment
Today's brief leads with pacioli: Incorrect Authorization. All 2 selected findings retain their own technical scope, action, observed status, and evidence limits.
Panel synthesis: Finding 02 should lead today because it is a path traversal issue with exploitation status unknown and a clear fixed version plus proxy mitigation. Finding 01 remains medium severity, but the listing says no exploitation is reported. Themes: Path traversal via query parameters; Consent and credential scoping; Compensating controls before upgrades. Patch order: Finding 02 (Exploitation is unknown; fixed in Shiny for Python 1.6.4, with _state_id_ stripping available at the reverse proxy or load balancer); Finding 01 (No exploitation is reported; fixed in pacioli-guard 0.10.0, with 0.9.6 controls around require_consent removal and governed credential scoping).
Finding 01 — pacioli: Incorrect Authorization
What changed: GitHub Advisory Database published GHSA-3hj7-6vmj-h8v4 for CVE-2026-107841 (pacioli): Incorrect Authorization, CVSS v3.1 5.7; affected: pacioli-guard 0.9.6, the only released version in the affected range.
Technical evidence: CVE-2026-107841; CVSS v3.1 5.7; weakness CWE-863; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Analyst note: On 0.9.6, remove require_consent from affected grants and rely on the credential-scoping floor alone. Alternatively, scope governed credentials so they cannot submit documents whose controllers cancel other documents. CISA ADP reports no exploitation. ([github.com](https://github.com/advisories/GHSA-3hj7-6vmj-h8v4), [cveawg.mitre.org](https://cveawg.mitre.org/api/cve/CVE-2026-107841))
Affected: pacioli-guard 0.9.6, the only released version in the affected range. ([github.com](https://github.com/advisories/GHSA-3hj7-6vmj-h8v4))
Fix: pacioli-guard 0.10.0. ([github.com](https://github.com/advisories/GHSA-3hj7-6vmj-h8v4))
Panel assessment: Patch pacioli-guard 0.9.6 to 0.10.0 this week: exploitation is not reported and CISA rates it non-automatable, but the flaw is an authorization failure that can partially affect document integrity inside the scope of governed credentials. The likely path is an authorised submit flow with require_consent that lets the caller name and cancel a pre-existing document, reaching document lifecycle controls rather than credential theft or data exfiltration. (priority: this week)
Action: Map CVE-2026-107841 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-3hj7-6vmj-h8v4)
Finding 02 — Shiny: Path Traversal
What changed: GitHub Advisory Database published GHSA-47c3-hpmg-7j6p for CVE-2026-108258 (Shiny): Path Traversal, CVSS v4.0 6.9; affected: Shiny for Python versions 1.4.0 through 1.6.3.
Technical evidence: CVE-2026-108258; CVSS v4.0 6.9; weakness CWE-22; technical confidence High.
Why it matters: The Medium priority requires exposure validation and scheduled remediation through normal change control.
Observed status: Observed in-the-wild exploitation status is unknown.
Analyst note: Strip the _state_id_ parameter from incoming query strings at the reverse proxy or load balancer. ([api.github.com](https://api.github.com/advisories/GHSA-47c3-hpmg-7j6p))
Affected: Shiny for Python versions 1.4.0 through 1.6.3. ([api.github.com](https://api.github.com/advisories/GHSA-47c3-hpmg-7j6p))
Fix: Shiny for Python version 1.6.4. ([api.github.com](https://api.github.com/advisories/GHSA-47c3-hpmg-7j6p))
Action: Map CVE-2026-108258 to owned assets, confirm the affected and fixed versions in the cited source, deploy the applicable remediation, and retain evidence of the exposure decision.
[Evidence source: github.com](https://github.com/advisories/GHSA-47c3-hpmg-7j6p)