CVE-2026-72543: OpenSign Information Disclosure Flaw

CVE-2026-72543 Overview

CVE-2026-72543 is an insecure direct object reference (IDOR) vulnerability in OpenSignLabs OpenSign through version 2.37.0. The flaw resides in the getcontact Parse cloud function, which executes with useMasterKey and performs no authentication or authorization checks. Unauthenticated remote attackers can retrieve any contact record, including personally identifiable information (PII), by supplying arbitrary object identifiers. The issue is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated attackers can enumerate and exfiltrate every contact record stored in an OpenSign deployment, resulting in bulk PII disclosure without credentials or user interaction.

Affected Products

OpenSignLabs OpenSign through version 2.37.0
Deployments exposing the getcontact Parse cloud function to network traffic
Self-hosted OpenSign instances relying on default cloud function permissions

Discovery Timeline

2026-08-11 - CVE-2026-72543 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72543

Vulnerability Analysis

OpenSign is an open-source document signing platform built on the Parse Server framework. Parse cloud functions run server-side logic that clients invoke through the Parse API. The getcontact cloud function accepts a contact object identifier and returns the associated contact record.

The function executes queries with useMasterKey, a Parse flag that bypasses class-level permissions and object-level access control lists (ACLs). Because the function does not validate the caller's session token or verify ownership of the requested object, any network client can invoke it and receive the requested record. Attackers can iterate through Parse object identifiers to enumerate the full contact database.

The returned data includes PII such as names, email addresses, and phone numbers stored in OpenSign contact records used for document workflows.

Root Cause

The root cause is missing authorization enforcement inside a privileged cloud function. Using useMasterKey in Parse elevates the query context to master-level access, which is intended for administrative operations. When combined with the absence of session validation or ownership checks, the function grants unauthenticated callers the same read access as an administrator. This pattern maps directly to [CWE-639], where an object reference supplied by the user is honored without verifying the user has rights to that object.

Attack Vector

Exploitation requires only network access to the OpenSign Parse API endpoint. An attacker sends a POST request to the cloud function endpoint invoking getcontact with a target objectId. No credentials, session cookies, or master keys are required. Parse object identifiers follow a predictable 10-character alphanumeric format, enabling enumeration by iterating candidate values or scraping identifiers from adjacent endpoints. Details on the vulnerable code path are available in the OpenSign GitHub repository.

No public proof-of-concept exploit or Exploit-DB entry has been published at the time of writing.

Detection Methods for CVE-2026-72543

Indicators of Compromise

Unauthenticated POST requests to /parse/functions/getcontact originating from a single source IP
High-volume sequential requests to the getcontact endpoint suggesting object identifier enumeration
Parse server logs showing cloud function invocations without associated session tokens
Egress traffic spikes from the OpenSign application server following bulk getcontact calls

Detection Strategies

Inspect web server and reverse proxy access logs for repeated calls to /parse/functions/getcontact from the same client
Correlate cloud function invocations with the absence of an X-Parse-Session-Token header to identify unauthenticated access
Deploy web application firewall (WAF) rules that flag anonymous requests to Parse cloud functions returning contact objects
Baseline normal getcontact call rates per authenticated user and alert on statistical outliers

Monitoring Recommendations

Forward Parse Server and OpenSign application logs to a centralized SIEM for retention and correlation
Enable request-level auditing on the Parse endpoint, capturing source IP, headers, and payload metadata
Monitor for outbound data transfers that exceed baseline volume during off-hours

How to Mitigate CVE-2026-72543

Immediate Actions Required

Restrict network exposure of the OpenSign Parse API to trusted networks or authenticated reverse proxies until a patched version is deployed
Audit access logs for prior invocations of the getcontact cloud function to identify potential data exposure
Notify affected users if log review indicates unauthorized contact record retrieval, in line with applicable breach notification obligations
Rotate any API tokens or master keys that may have been observed in logs during triage

Patch Information

At the time of publication, no fixed version has been referenced in the NVD entry. Monitor the OpenSign GitHub repository for a release addressing the getcontact authorization check. Once available, upgrade all OpenSign deployments beyond version 2.37.0 and validate that the cloud function enforces session-based authorization.

Workarounds

Apply a reverse proxy rule that blocks unauthenticated requests to /parse/functions/getcontact by requiring a valid X-Parse-Session-Token header
Modify the cloud function to validate the caller's session and verify ownership of the requested contact before returning data
Remove useMasterKey from the query and rely on Parse ACLs to enforce object-level access
Place the OpenSign application behind a VPN or identity-aware proxy to eliminate anonymous access

bash

# Example NGINX rule to block unauthenticated getcontact calls
location = /parse/functions/getcontact {
    if ($http_x_parse_session_token = "") {
        return 401;
    }
    proxy_pass http://opensign_backend;
}