CVE-2026-72692

Name of the Vulnerable Software and Affected Versions opensignserver versions prior to 2.37.1

Description A missing authorization issue allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user. This is possible through the declinedoc Parse cloud function, which writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the identity of the caller. This flaw enables the termination of workflows and the falsification of evidentiary records for any accessible document.

Recommendations Update opensignserver to version 2.37.1 or later. As a temporary mitigation, restrict access to the declinedoc Parse cloud function.