CVE-2026-92794 — OpenSign through 2.41.3 Information Disclosure via getDocument
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document iden…
Published: 2026-09-16 · CVSS: 8.7 · CVSS 4.0
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identity, and valid download tokens without authentication.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7