CVE-2026-72548 Overview
CVE-2026-72548 is an information disclosure vulnerability affecting OpenSignLabs OpenSign through version 2.37.0. The flaw resides in the gettenant Parse cloud function, which accepts a contactId parameter and returns the complete tenant record without performing authentication or authorization checks. Unauthenticated remote attackers can enumerate and retrieve tenant configuration data for any organisation hosted on a vulnerable OpenSign deployment. The vulnerability is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Any unauthenticated attacker with network access to an OpenSign instance can enumerate contactId values and disclose full tenant records for every organisation in the system.
Affected Products
- OpenSignLabs OpenSign through version 2.37.0
- Deployments exposing the Parse cloud function endpoint gettenant
- Self-hosted and cloud-hosted OpenSign multi-tenant instances
Discovery Timeline
- 2026-08-11 - CVE-2026-72548 published to the National Vulnerability Database
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72548
Vulnerability Analysis
OpenSign is an open-source electronic signature platform built on the Parse Server framework. Parse cloud functions execute server-side logic and are typically invoked over HTTP by client applications. The gettenant cloud function returns tenant records used to configure organisation-level branding, workflows, and settings.
The function accepts a caller-supplied contactId argument and queries the underlying tenant collection using that identifier. It does not verify whether the requesting session belongs to a user in that tenant, and it does not require any authenticated session at all. As a result, the function returns the full tenant object to any caller who supplies a valid contactId.
Because contactId values are enumerable, an attacker can iterate identifiers to harvest tenant records across the deployment. Exposed data can include internal configuration, integration settings, and metadata that supports further targeted attacks against the affected organisations.
Root Cause
The root cause is missing authentication and missing authorization on a server-side cloud function that exposes tenant-scoped data. The gettenant handler trusts the client-supplied contactId without validating the session context or enforcing tenant isolation.
Attack Vector
Exploitation requires only network access to the OpenSign application. An attacker sends a Parse cloud function invocation to the gettenant endpoint with a contactId value, and the server responds with the corresponding tenant record. No credentials, user interaction, or elevated privileges are required. See the OpenSign repository for source code references.
Detection Methods for CVE-2026-72548
Indicators of Compromise
- HTTP POST requests to the Parse endpoint /functions/gettenant (or the equivalent Parse cloud function route) originating from unauthenticated sessions.
- High-volume or sequential requests to gettenant with varying contactId parameter values, indicating enumeration.
- Requests to gettenant from source IP addresses that have never authenticated to the application.
Detection Strategies
- Review application and reverse-proxy access logs for invocations of gettenant and correlate them with the presence of a valid session cookie or Parse session token.
- Alert on repeated gettenant calls that vary only in the contactId parameter within a short time window.
- Instrument Parse Server middleware to log the authentication state of every cloud function invocation and flag anonymous calls to tenant-scoped functions.
Monitoring Recommendations
- Forward OpenSign and Parse Server logs to a centralized analytics platform and build queries that isolate anonymous access to sensitive cloud functions.
- Monitor egress volumes and response sizes for the gettenant endpoint, since bulk enumeration produces detectable spikes.
- Track first-seen contactId values per source IP to identify enumeration behavior.
How to Mitigate CVE-2026-72548
Immediate Actions Required
- Restrict network exposure of the OpenSign application to trusted networks or place it behind an authenticating reverse proxy until a patched release is deployed.
- Disable or remove the gettenant cloud function if it is not required by production workflows.
- Audit access logs for prior invocations of gettenant by unauthenticated clients and identify tenants whose records may have been disclosed.
Patch Information
At the time of publication, no fixed version is listed in the NVD entry for OpenSignLabs OpenSign. Monitor the OpenSign GitHub repository for a release later than 2.37.0 that adds authentication and tenant-scope enforcement to the gettenant cloud function.
Workarounds
- Add a Parse Server beforeFunction trigger for gettenant that rejects requests lacking a valid session token.
- Enforce tenant scoping by validating that the authenticated user's tenant identifier matches the tenant associated with the supplied contactId.
- Block direct external access to /functions/gettenant at the web application firewall or reverse proxy layer until server-side authorization is implemented.
# Example WAF rule: block unauthenticated access to the vulnerable Parse function
# (adjust to match your WAF syntax and session cookie name)
SecRule REQUEST_URI "@endsWith /functions/gettenant" \
"id:1072548,phase:1,deny,status:401,\
chain,msg:'Block unauthenticated gettenant calls (CVE-2026-72548)'"
SecRule &REQUEST_COOKIES:parse_session "@eq 0"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
