CVE-2026-92794: OpenSign through 2.41.3 Information Disclosure via getDocument
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identity, and valid download tokens without authentication.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OpenSignto a version that resolves this vulnerability.Fixed in 2.41.3 - Configuration
Enable one-time-password verification so that getDocument validates caller identity; the vulnerability occurs when one-time-password verification is disabled.
OpenSign cloud function getDocument one-time-password verification = enabled
Event History
Frequently Asked Questions
Who is exposed to this issue?
OpenSign deployments through 2.41.3 are exposed when one-time-password verification is disabled and the getDocument cloud function is reachable. The issue concerns documents associated with guest signing links.
What does an attacker need to retrieve document data?
An attacker needs a document identifier obtained from a guest signing link. No authentication is required under the affected configuration.
What information can be disclosed?
An attacker can retrieve complete document details, including information for all signers, the sender's identity, and valid download tokens.
What should be prioritized if immediate patching is not possible?
Enable one-time-password verification, because the described identity-validation failure applies when that verification is disabled.