CVE-2026-72549: OpenSign Information Disclosure Flaw

CVE-2026-72549 Overview

CVE-2026-72549 is an information disclosure vulnerability affecting OpenSignLabs OpenSign through version 2.37.0. The flaw resides in the getUserId Parse cloud function, which resolves an email address or username to its internal user objectId without performing any authentication. Unauthenticated remote attackers can query the function over the network to map arbitrary email addresses or usernames to internal identifiers. This capability enables user enumeration and supports follow-on attacks such as targeted phishing, credential stuffing, and account takeover attempts. The issue is categorized as sensitive information exposure [CWE-200].

Critical Impact
Unauthenticated attackers can enumerate valid user accounts and map them to internal identifiers, providing reconnaissance data for subsequent targeted attacks.

Affected Products

OpenSignLabs OpenSign versions through 2.37.0
Deployments exposing the Parse Server getUserId cloud function
Self-hosted and containerized OpenSign instances reachable over the network

Discovery Timeline

2026-08-11 - CVE-2026-72549 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-72549

Vulnerability Analysis

OpenSign is an open-source electronic signature platform built on Parse Server. Parse Server exposes application logic through cloud functions that clients invoke over HTTPS. The getUserId cloud function accepts an email address or username as input and returns the corresponding internal user objectId.

The function omits an authentication check before executing the lookup. Any remote client that can reach the Parse API endpoint can invoke getUserId and receive a valid identifier when the supplied email or username exists. This behavior converts an internal helper function into an unauthenticated user enumeration oracle.

The returned objectId is the primary key used across the OpenSign data model. Attackers who correlate identifiers with valid accounts gain a curated target list for password spraying, credential stuffing, phishing, and other identity-based attacks against the platform.

Root Cause

The root cause is missing authorization on a sensitive cloud function [CWE-200]. The getUserId handler processes requests without validating a session token or verifying that the caller is entitled to resolve arbitrary user identifiers. The distinct responses for existing versus non-existing accounts create a reliable enumeration signal.

Attack Vector

Exploitation requires only network access to the OpenSign Parse API. An attacker sends a POST request invoking the getUserId cloud function with a candidate email address or username. A successful response containing an objectId confirms account existence and reveals the internal identifier. Attackers can automate this against email lists or dictionaries to build enumerated account inventories at scale.

No verified proof-of-concept code is published. Refer to the GitHub OpenSign Repository for the affected function implementation.

Detection Methods for CVE-2026-72549

Indicators of Compromise

High-volume invocations of the getUserId Parse cloud function from a single source IP or narrow IP range
Sequential or dictionary-style requests containing varied email addresses or usernames against /parse/functions/getUserId
Requests to the Parse functions endpoint lacking a valid session token header (X-Parse-Session-Token)

Detection Strategies

Enable Parse Server request logging and alert on repeated calls to getUserId from unauthenticated sessions
Deploy web application firewall rules that rate-limit cloud function calls and flag high-cardinality email parameters
Correlate enumeration bursts with subsequent authentication attempts against the same accounts to identify staged attacks

Monitoring Recommendations

Ingest OpenSign application logs and Parse Server access logs into a centralized SIEM for behavioral analysis
Baseline normal getUserId call volume and alert on statistical deviations
Monitor for user agent patterns and request timing consistent with automated enumeration tooling

How to Mitigate CVE-2026-72549

Immediate Actions Required

Upgrade OpenSign to a version later than 2.37.0 once a patched release is available from OpenSignLabs
Restrict network exposure of the Parse API endpoint to trusted clients or place it behind an authenticated reverse proxy
Apply strict rate limiting to /parse/functions/getUserId at the load balancer or WAF layer

Patch Information

No vendor patch is referenced in the NVD entry at time of publication. Monitor the GitHub OpenSign Repository for security releases addressing the missing authentication in the getUserId cloud function.

Workarounds

Override the getUserId cloud function to require a valid Parse session token before resolving identifiers
Return a uniform response for both existing and non-existent accounts to remove the enumeration signal
Deploy WAF rules that block unauthenticated POST requests to /parse/functions/getUserId
Enforce multi-factor authentication across all OpenSign accounts to reduce impact of downstream credential attacks

bash

# Example Parse Server cloud function guard requiring authentication
Parse.Cloud.define('getUserId', async (request) => {
  if (!request.user) {
    throw new Parse.Error(
      Parse.Error.INVALID_SESSION_TOKEN,
      'Authentication required'
    );
  }
  // existing lookup logic
});