Skip to content

Product

OpenSignLabs OpenSign vulnerabilities

6 published CVES affecting OpenSignLabs OpenSign, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
6
Critical
0
High
5
Medium
1
Low
0
Unscored
0
CISA KEV
0

Latest OpenSignLabs OpenSign CVEs

Newest publication first

  1. CVE-2026-92794 OpenSign through 2.41.3 Information Disclosure via getDocument

    Published
    HighCVSS 8.7 EPSS 0.59%

    OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' informatio...

  2. CVE-2026-72549 OpenSignLabs OpenSign - Information Disclosure

    Published
    MediumCVSS 5.3 EPSS 0.48%

    An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolv...

  3. CVE-2026-72548 OpenSignLabs OpenSign - Information Disclosure

    Published
    HighCVSS 7.5 EPSS 0.61%

    An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record...

  4. CVE-2026-72545 OpenSignLabs OpenSign - Insecure Direct Object Reference

    Published
    HighCVSS 7.5 EPSS 0.54%

    An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updatin...

  6. CVE-2026-72543 OpenSignLabs OpenSign - Insecure Direct Object Reference

    Published
    HighCVSS 7.5 EPSS 0.61%

    An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or auth...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.