CVE-2026-72691

An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed by supplying an arbitrary string as docId.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenSignLabs/OpenSign

Configurations

No configuration.

History

23 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de omisión de autenticación en OpenSignLabs opensignserver hasta 2.37.0 permite a un atacante remoto no autenticado acuñar tokens de acceso a archivos firmados con MASTER_KEY para archivos almacenados arbitrarios a través de la función en la nube de Parse getsignedurl. La función omite su verificación isAuthenticated siempre que se suministre cualquier parámetro docId, incluso uno que no corresponda a ningún documento real, permitiendo que la puerta de autenticación sea omitida al suministrar una cadena arbitraria como docId.

Information

Published : 2026-08-10 13:20

Updated : 2026-10-24 15:10

NVD link : CVE-2026-72691

Mitre link : CVE-2026-72691

CVE.ORG link : CVE-2026-72691

JSON object : View

Products Affected

No product.

CWE

CWE-288

Authentication Bypass Using an Alternate Path or Channel

{"id": "CVE-2026-72691", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72691", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-10T15:37:46.009148Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "affectedData": [{"vendor": "OpenSignLabs", "product": "opensignserver", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.37.0"}], "defaultStatus": "affected"}]}], "published": "2026-08-10T13:20:39.350", "references": [{"url": "https://github.com/OpenSignLabs/OpenSign", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c", "description": [{"lang": "en", "value": "CWE-288"}]}], "descriptions": [{"lang": "en", "value": "An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed by supplying an arbitrary string as docId."}, {"lang": "es", "value": "Una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n en OpenSignLabs opensignserver hasta 2.37.0 permite a un atacante remoto no autenticado acu\u00f1ar tokens de acceso a archivos firmados con MASTER_KEY para archivos almacenados arbitrarios a trav\u00e9s de la funci\u00f3n en la nube de Parse getsignedurl. La funci\u00f3n omite su verificaci\u00f3n isAuthenticated siempre que se suministre cualquier par\u00e1metro docId, incluso uno que no corresponda a ning\u00fan documento real, permitiendo que la puerta de autenticaci\u00f3n sea omitida al suministrar una cadena arbitraria como docId."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c"}