CVE-2026-72545

Name of the Vulnerable Software and Affected Versions OpenSignLabs OpenSign versions prior to 2.37.1

Description An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, unauthenticated remote attackers can write to any contact record using the updatecontacttour Parse cloud function. Because the function lacks authentication and authorization checks, an attacker can corrupt or overwrite contact data for any user in the system without providing credentials.

Recommendations Update OpenSignLabs OpenSign to version 2.37.1 or later. As a temporary workaround, restrict access to the updatecontacttour Parse cloud function to minimize the risk of exploitation.