CVE-2026-71247: Documenso Auth Bypass Vulnerability

CVE-2026-71247 Overview

CVE-2026-71247 is an authorization flaw in Documenso's document-signing backend. The vulnerable handler sign-field-with-token.ts permits a recipient assigned the ASSISTANT role to fetch and complete fields belonging to other recipients in the same envelope. The handler creates a Signature record tied to the target field's recipientId without verifying field ownership or that field.type equals SIGNATURE. In sequential-signing workflows, an assistant can forge signatures on behalf of later or equal-order recipients who have not yet signed. The issue is tracked under CWE-863: Incorrect Authorization.

Critical Impact
An authenticated assistant recipient can forge another signer's signature field in the same envelope, breaking the integrity of sequentially signed documents.

Affected Products

Documenso document-signing platform (V1 signing path)
sign-field-with-token.ts handler used by the live signing UI
Envelopes configured with sequential signing and an ASSISTANT recipient

Discovery Timeline

2026-08-05 - CVE-2026-71247 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-71247

Vulnerability Analysis

Documenso supports envelopes with multiple recipient roles, including ASSISTANT, which is intended to help other signers complete non-signature fields. The V1 signing endpoint accepts a token plus a target field identifier and upserts a Signature row keyed on the field's owning recipientId. The handler does not check that the acting recipient owns the field, nor that the field type is compatible with the caller's role. An assistant recipient can therefore submit values for fields belonging to any later-or-equal-order recipient who has not yet signed, including SIGNATURE fields.

This breaks the trust model of sequential signing: downstream signers expect that only they can complete their own signature fields. The forged signature is stored as a legitimate Signature record, indistinguishable at the data layer from one produced by the intended signer.

Root Cause

The root cause is a missing authorization check in sign-field-with-token.ts. The handler validates the token but omits two guards: (1) verifying that field.recipientId matches the token-holder's recipient ID, and (2) blocking assistants from writing to SIGNATURE-type fields. The newer V2 handler sign-envelope-field.ts explicitly enforces the second guard, and comments in the project's own test suite confirm the V1 path lacks it.

Attack Vector

Exploitation requires authenticated access as an ASSISTANT recipient on a shared envelope. The attacker sends a signing request through the V1 API with the target field ID and a forged signature payload. Because privileges required are low and no user interaction from the victim is needed, the flaw is remotely exploitable over the network. Confidentiality is not affected, but integrity of signed documents is compromised. See the Documenso GitHub repository for the affected source files.

Detection Methods for CVE-2026-71247

Indicators of Compromise

Signature records where the creating session's recipient token does not match the recipientId on the field.
Multiple SIGNATURE-type field completions on a single envelope originating from the same IP or session used by an ASSISTANT recipient.
Audit-log entries showing an assistant completing fields ordered after their own signing step in a sequential envelope.

Detection Strategies

Review application logs for calls to the V1 sign-field-with-token endpoint where the acting recipient role is ASSISTANT and the target field.type is SIGNATURE.
Correlate Signature insertions with envelope recipient order to flag out-of-sequence completions.
Compare V1 and V2 handler usage; alert when V1 remains reachable for envelopes containing assistant recipients.

Monitoring Recommendations

Enable verbose request logging on the signing API and forward events to a central log store for retention and query.
Alert on any Signature record whose associated recipient is not the caller identified by the signing token.
Track envelope completion patterns to detect single sessions completing multiple recipients' fields.

How to Mitigate CVE-2026-71247

Immediate Actions Required

Upgrade Documenso to a release that includes the authorization fix in sign-field-with-token.ts or routes signing exclusively through the V2 sign-envelope-field.ts handler.
Audit existing envelopes signed with assistant recipients present, and re-issue any documents where a SIGNATURE field was completed out of order.
Restrict use of the ASSISTANT role until the patched version is deployed.

Patch Information

Monitor the Documenso GitHub repository for release notes addressing this authorization gap. The V2 signing path (sign-envelope-field.ts) already contains the missing guard and should be preferred once the V1 handler is retired or fixed.

Workarounds

Configure envelopes without the ASSISTANT role until a patched build is in place.
Front the signing API with a reverse-proxy rule that rejects V1 sign-field-with-token requests when the caller's role is ASSISTANT.
Require post-signing manual review of documents that include assistant recipients before considering them legally executed.

bash

# Example reverse-proxy rule (nginx) to block V1 assistant signing until patched
location /api/sign-field-with-token {
    if ($http_x_recipient_role = "ASSISTANT") {
        return 403;
    }
    proxy_pass http://documenso_upstream;
}