CVE-2026-72689: OpenSignLabs opensignserver - Broken Object Level Authorization
A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the document's IsEnableOTP flag is unset, which is the default configuration.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Enable OTP so that the getDocument Parse cloud function does not return full records and pre-signed document download URLs under the default condition where IsEnableOTP is unset.
OpenSignLabs opensignserver (documents / IsEnableOTP) IsEnableOTP = set - Compensating control
Restrict network access to OpenSignLabs opensignserver so unauthenticated remote attackers cannot reach it (e.g., block inbound access to the service endpoints at the firewall/ACL/WAF).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72689?
CVE-2026-72689 has a high severity rating of 7.5.
How do I fix CVE-2026-72689?
To fix CVE-2026-72689, ensure that object-level authorization is properly implemented and avoid using the useMasterKey in sensitive operations.
What systems are affected by CVE-2026-72689?
CVE-2026-72689 affects OpenSignLabs opensignserver versions prior to 2.38.0.
Can CVE-2026-72689 be exploited remotely?
Yes, CVE-2026-72689 can be exploited by an unauthenticated remote attacker.
What type of data can be accessed through CVE-2026-72689?
Through CVE-2026-72689, attackers can read complete contract records.