CVE-2026-71247: Documenso: Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents
Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler upserts a Signature record tied to the target field's recipientId with no check that field.type is SIGNATURE and the acting recipient owns it. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here. In a sequential-signing document, an assistant recipient can therefore forge another signer's signature field.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify Documenso's sign-field-with-token.ts handler to add explicit authorization checks: verify the acting recipient is the owner of the target field (matches recipientId) and restrict completion/upsert to fields where field.type is exactly 'SIGNATURE'. The current code upserts Signature records tied to target field recipientId with no check that field.type is SIGNATURE and the acting recipient owns it.
Documenso (sign-field-with-token.ts) Field update authorization (Signature field type and ownership checks) = Enforce that only recipient-owned fields of field.type === 'SIGNATURE' can be fetched/completed by ASSISTANT; deny completing fields of other recipients.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71247?
The severity of CVE-2026-71247 is medium with a score of 6.5.
How can I fix CVE-2026-71247?
To fix CVE-2026-71247, ensure that only authorized recipients can access and interact with the relevant signing fields.
What are the potential impacts of CVE-2026-71247?
CVE-2026-71247 allows an Assistant recipient to forge another signer's signature in sequential-signing documents, compromising document integrity.
Which software is affected by CVE-2026-71247?
The affected software by CVE-2026-71247 is the Documenso live document-signing UI.
When was CVE-2026-71247 published?
CVE-2026-71247 was published on August 5, 2026.