CVE-2026-72548: OpenSignLabs OpenSign - Information Disclosure
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSignLabs OpenSignto a version that resolves this vulnerability.Fixed in 2.37.0 - Compensating control
Restrict network access so unauthenticated remote attackers cannot invoke the OpenSign gettenant Parse cloud function (e.g., block external access to Parse cloud function endpoints at the firewall/reverse proxy) until the underlying access-control issue is fixed.