CVE-2026-72545: OpenSign Auth Bypass Vulnerability

CVE-2026-72545 Overview

CVE-2026-72545 is an Insecure Direct Object Reference (IDOR) vulnerability in OpenSignLabs OpenSign through version 2.37.0. The flaw resides in the updatecontacttour Parse cloud function, which performs no authentication or authorization before updating a target contact record. Unauthenticated remote attackers can write to any contact record in the system, corrupting or overwriting contact data belonging to any user. The weakness is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated attackers can overwrite arbitrary contact records across the OpenSign deployment, causing integrity loss for stored contact data used in document signing workflows.

Affected Products

OpenSignLabs OpenSign versions up to and including 2.37.0
Deployments exposing the updatecontacttour Parse cloud function
Self-hosted OpenSign instances reachable over the network

Discovery Timeline

2026-08-11 - CVE-2026-72545 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72545

Vulnerability Analysis

OpenSign exposes server-side Parse cloud functions to handle contact management operations. The updatecontacttour function accepts a target contact identifier from the caller and issues an update against the corresponding record. The handler omits any check that binds the requested contact identifier to the calling session or user.

Because the function does not validate the caller's identity, an attacker can send a crafted request that references any contact object ID. The server processes the update as though it originated from a legitimate owner. This grants integrity impact across every contact record stored in the platform without requiring credentials or user interaction.

Root Cause

The root cause is a missing authorization check in the updatecontacttour cloud function. Parse Server exposes cloud functions over a network endpoint, and access control must be implemented explicitly inside each function. The handler neither verifies request.user nor confirms that the caller owns the referenced contact object, producing a classic IDOR condition [CWE-639].

Attack Vector

Exploitation requires only network reachability to the OpenSign Parse API endpoint. An attacker enumerates or guesses contact object identifiers, then issues a POST request invoking updatecontacttour with attacker-controlled field values. The server writes the supplied values to the referenced contact record. No authentication token, session cookie, or CSRF prerequisite is required.

Technical details are available in the OpenSign GitHub Repository.

Detection Methods for CVE-2026-72545

Indicators of Compromise

Unexpected modifications to Contact collection records without corresponding authenticated user sessions in Parse Server logs
Requests to /parse/functions/updatecontacttour originating from IP addresses without prior authentication activity
High-volume POST requests to Parse cloud function endpoints targeting sequential or enumerated object identifiers

Detection Strategies

Review Parse Server request logs for invocations of updatecontacttour where the session token is missing or unassociated with the referenced contact owner
Compare contact record updatedAt timestamps against known legitimate user activity windows to surface unauthorized writes
Alert on anomalous write volume to the Contact collection from single client sources

Monitoring Recommendations

Enable verbose logging on the Parse Server instance and forward events to a centralized SIEM for correlation
Baseline normal call patterns for OpenSign cloud functions and alert on deviations from expected caller identity or frequency
Monitor upstream reverse proxy or WAF logs for unauthenticated requests targeting /parse/functions/ endpoints

How to Mitigate CVE-2026-72545

Immediate Actions Required

Upgrade OpenSign to a release later than 2.37.0 once the vendor publishes a fix addressing the updatecontacttour authorization gap
Restrict network exposure of the OpenSign Parse API to trusted networks or place it behind an authenticating reverse proxy
Audit the Contact collection for unexpected modifications and restore records from backups where tampering is confirmed

Patch Information

At the time of publication, refer to the OpenSign GitHub Repository for the latest releases and commit history addressing this issue. Administrators should track the repository for a version beyond 2.37.0 that adds authentication and ownership checks to the updatecontacttour cloud function.

Workarounds

Deploy a reverse proxy rule that blocks unauthenticated requests to /parse/functions/updatecontacttour
Modify the updatecontacttour cloud function locally to require request.user and validate ownership of the referenced contact object before executing the update
Disable the updatecontacttour function entirely if the onboarding tour feature is not required in your deployment

bash

# Example nginx snippet restricting the vulnerable endpoint to authenticated internal traffic
location = /parse/functions/updatecontacttour {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://opensign_backend;
}