CVE-2026-72689 — OpenSignLabs opensignserver - Broken Object Level Authorization
A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via t…
Published: 2026-08-10 · CVSS: 7.5 · CVSS 3.1
A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the document's IsEnableOTP flag is unset, which is the default configuration.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7