CVE-2026-72543

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks before returning the requested contact object. An attacker can enumerate and read all contact records including personally identifiable information without credentials.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenSignLabs/OpenSign

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de referencia directa insegura a objetos en OpenSignLabs OpenSign hasta la versión 2.37.0 permite a atacantes remotos no autenticados recuperar cualquier registro de contacto a través de la función de nube ’getcontact’ de Parse. La función se ejecuta con ’useMasterKey’ y no realiza comprobaciones de autenticación ni de autorización antes de devolver el objeto de contacto solicitado. Un atacante puede enumerar y leer todos los registros de contacto, incluyendo información de identificación personal, sin credenciales.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72543

Mitre link : CVE-2026-72543

CVE.ORG link : CVE-2026-72543

JSON object : View

Products Affected

No product.

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-72543", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72543", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T14:47:21.567095Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "OpenSignLabs", "product": "OpenSign", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.37.0"}]}]}], "published": "2026-08-11T12:17:39.727", "references": [{"url": "https://github.com/OpenSignLabs/OpenSign", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks before returning the requested contact object. An attacker can enumerate and read all contact records including personally identifiable information without credentials."}, {"lang": "es", "value": "Una vulnerabilidad de referencia directa insegura a objetos en OpenSignLabs OpenSign hasta la versi\u00f3n 2.37.0 permite a atacantes remotos no autenticados recuperar cualquier registro de contacto a trav\u00e9s de la funci\u00f3n de nube \u2019getcontact\u2019 de Parse. La funci\u00f3n se ejecuta con \u2019useMasterKey\u2019 y no realiza comprobaciones de autenticaci\u00f3n ni de autorizaci\u00f3n antes de devolver el objeto de contacto solicitado. Un atacante puede enumerar y leer todos los registros de contacto, incluyendo informaci\u00f3n de identificaci\u00f3n personal, sin credenciales."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}