CVE-2026-82472: Documenso Missing Cancelled Status Check

Envelope permission checks validate rejected and completed states but omit validation for the cancelled status, potentially allowing modification of cancelled envelopes.

Provally CuratedPublic repositoryMediumMedium confidenceVerifiedApache-2.0TS
greprules fetch cve-2026-82472-documenso-missing-cancelled-status-check --engine opengrep

Description

Envelope permission checks validate rejected and completed states but omit validation for the cancelled status, potentially allowing modification of cancelled envelopes.