CVE-2026-72689

Name of the Vulnerable Software and Affected Versions opensignserver versions prior to 2.38.0

Description A broken object-level authorization issue exists in the getDocument Parse cloud function. This allows an unauthenticated remote attacker to read complete contract records, including personally identifiable information (PII) of the sender and signer, as well as a pre-signed document download URL. The issue occurs because the function utilizes useMasterKey to fetch documents, which bypasses the object Access Control List (ACL). This behavior is triggered whenever the IsEnableOTP flag of a document is unset, which is the default configuration.

Recommendations Update opensignserver to version 2.38.0 or later. As a temporary mitigation, ensure the IsEnableOTP flag is set for all documents to prevent unauthorized access via the getDocument function.