CVE-2026-72692: OpenSignLabs opensignserver - Missing Authorization
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72692?
CVE-2026-72692 has a severity score of 7.5, indicating a high risk level.
What is CVE-2026-72692 related to?
CVE-2026-72692 pertains to a missing authorization vulnerability in OpenSignLabs opensignserver that allows unauthorized document manipulation.
How can an attacker exploit CVE-2026-72692?
An attacker can exploit CVE-2026-72692 to irreversibly decline documents and forge decline attribution by using the declinedoc Parse cloud function.
What versions of OpenSignLabs opensignserver are affected by CVE-2026-72692?
CVE-2026-72692 affects OpenSignLabs opensignserver versions prior to 2.37.0.
How do I fix CVE-2026-72692?
To mitigate CVE-2026-72692, update your OpenSignLabs opensignserver to version 2.37.0 or later.