CVE-2026-72548

Name of the Vulnerable Software and Affected Versions OpenSignLabs OpenSign versions prior to 2.37.1

Description An information disclosure issue exists where unauthenticated remote attackers can retrieve organization tenant records. This is possible through the gettenant Parse cloud function, which accepts a contactId parameter and returns the full tenant record without performing authentication or authorization checks. This allows for the enumeration and disclosure of tenant configuration data for any organization within the system.

Recommendations Update OpenSignLabs OpenSign to version 2.37.1 or later. As a temporary workaround, restrict access to the gettenant function to minimize the risk of exploitation.