CVE-2026-72549

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can use this to enumerate user accounts and target subsequent attacks.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenSignLabs/OpenSign

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de revelación de información en OpenSignLabs OpenSign hasta la versión 2.37.0 permite a atacantes remotos no autenticados mapear cualquier dirección de correo electrónico o nombre de usuario a su objectId de usuario interno a través de la función de nube Parse getUserId. La función no realiza ninguna autenticación antes de resolver y devolver el identificador interno. Un atacante puede usar esto para enumerar cuentas de usuario y dirigir ataques posteriores.

Information

Published : 2026-08-11 12:17

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72549

Mitre link : CVE-2026-72549

CVE.ORG link : CVE-2026-72549

JSON object : View

Products Affected

No product.

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-72549", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72549", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-11T15:09:06.730884Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "OpenSignLabs", "product": "OpenSign", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2.37.0"}]}]}], "published": "2026-08-11T12:17:40.483", "references": [{"url": "https://github.com/OpenSignLabs/OpenSign", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can use this to enumerate user accounts and target subsequent attacks."}, {"lang": "es", "value": "Una vulnerabilidad de revelaci\u00f3n de informaci\u00f3n en OpenSignLabs OpenSign hasta la versi\u00f3n 2.37.0 permite a atacantes remotos no autenticados mapear cualquier direcci\u00f3n de correo electr\u00f3nico o nombre de usuario a su objectId de usuario interno a trav\u00e9s de la funci\u00f3n de nube Parse getUserId. La funci\u00f3n no realiza ninguna autenticaci\u00f3n antes de resolver y devolver el identificador interno. Un atacante puede usar esto para enumerar cuentas de usuario y dirigir ataques posteriores."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}