CVE-2026-72691

Name of the Vulnerable Software and Affected Versions opensignserver versions prior to 2.37.1

Description An authentication bypass exists in the getsignedurl Parse cloud function. The function fails to perform the isAuthenticated check when a docId parameter is provided, regardless of whether the ID corresponds to a valid document. This allows an unauthenticated remote attacker to generate file access tokens signed with the MASTER KEY for any stored file by supplying an arbitrary string to the docId variable.

Recommendations Update opensignserver to version 2.37.1 or later. As a temporary mitigation, restrict access to the getsignedurl function.