CVE-2026-72544

An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without authentication, allowing fabrication of arbitrary audit log entries. An attacker can tamper with the legal audit trail of any signed document, undermining non-repudiation.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenSignLabs/OpenSign

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de verificación de integridad en OpenSignLabs OpenSign hasta la versión 2.37.0 permite a atacantes remotos no autenticados falsificar entradas de la pista de auditoría de documentos a través de la función en la nube triggerevent Parse. La función acepta la identidad del visor y la dirección IP como parámetros proporcionados por el llamante sin autenticación, permitiendo la fabricación de entradas de registro de auditoría arbitrarias. Un atacante puede manipular la pista de auditoría legal de cualquier documento firmado, socavando el no repudio.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72544

Mitre link : CVE-2026-72544

CVE.ORG link : CVE-2026-72544

JSON object : View

Products Affected

No product.

CWE

CWE-345

Insufficient Verification of Data Authenticity

{"id": "CVE-2026-72544", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72544", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T12:24:35.047280Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "OpenSignLabs", "product": "OpenSign", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.37.0"}]}]}], "published": "2026-08-11T12:17:39.847", "references": [{"url": "https://github.com/OpenSignLabs/OpenSign", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-345"}]}], "descriptions": [{"lang": "en", "value": "An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without authentication, allowing fabrication of arbitrary audit log entries. An attacker can tamper with the legal audit trail of any signed document, undermining non-repudiation."}, {"lang": "es", "value": "Una vulnerabilidad de verificaci\u00f3n de integridad en OpenSignLabs OpenSign hasta la versi\u00f3n 2.37.0 permite a atacantes remotos no autenticados falsificar entradas de la pista de auditor\u00eda de documentos a trav\u00e9s de la funci\u00f3n en la nube triggerevent Parse. La funci\u00f3n acepta la identidad del visor y la direcci\u00f3n IP como par\u00e1metros proporcionados por el llamante sin autenticaci\u00f3n, permitiendo la fabricaci\u00f3n de entradas de registro de auditor\u00eda arbitrarias. Un atacante puede manipular la pista de auditor\u00eda legal de cualquier documento firmado, socavando el no repudio."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}