CVE-2026-72543

Name of the Vulnerable Software and Affected Versions OpenSignLabs OpenSign versions prior to 2.37.1

Description An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, unauthenticated remote attackers can retrieve any contact record through the getcontact Parse cloud function. The function executes with useMasterKey and fails to perform authentication or authorization checks before returning the requested contact object, allowing the enumeration and retrieval of all contact records, including personally identifiable information.

Recommendations Update OpenSignLabs OpenSign to version 2.37.1 or later. As a temporary mitigation, restrict access to the getcontact Parse cloud function.