CVE-2026-72689: OpenSignLabs Information Disclosure Flaw

CVE-2026-72689 Overview

CVE-2026-72689 is a broken object-level authorization vulnerability in OpenSignLabs opensignserver through version 2.37.0. The flaw resides in the getDocument Parse cloud function, which fetches documents using useMasterKey and bypasses the object Access Control List (ACL). An unauthenticated remote attacker can read complete contract records, including sender and signer personally identifiable information (PII) and a pre-signed document download URL. The exposure occurs whenever the document's IsEnableOTP flag is unset, which is the default configuration. This weakness is classified under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Unauthenticated remote attackers can retrieve full signed contract records, signer PII, and pre-signed document download URLs from any OpenSign deployment running default settings.

Affected Products

OpenSignLabs opensignserver versions through 2.37.0
Deployments with the default IsEnableOTP flag unset
Self-hosted OpenSign instances exposing the Parse cloud API to untrusted networks

Discovery Timeline

2026-08-10 - CVE-2026-72689 published to the National Vulnerability Database (NVD)
2026-08-10 - Last updated in the NVD database

Technical Details for CVE-2026-72689

Vulnerability Analysis

OpenSign is an open-source electronic signature platform. Its backend, opensignserver, exposes a Parse Server cloud function named getDocument. This function is intended to return document metadata and content to authorized parties in a signing workflow.

The implementation calls Parse.Query with the useMasterKey: true option. Passing the master key instructs Parse Server to skip ACL and Class-Level Permission (CLP) enforcement entirely. As a result, any caller supplying a document objectId receives the full record back, regardless of session identity or role.

The returned payload contains signer and sender PII, workflow state, and a pre-signed URL to the underlying document object storage. The pre-signed URL grants direct download access without further authentication.

Root Cause

The root cause is misuse of Parse Server's master key inside a network-reachable cloud function. Master-key operations are intended for trusted server-to-server administrative logic, not for endpoints reachable by unauthenticated clients. The developer used useMasterKey to simplify document lookups, which removed the object-level authorization check that would normally reject callers lacking read ACL entries.

A secondary defect is the default value of IsEnableOTP. When unset, the function returns the record without requiring a one-time password (OTP) challenge. Deployments therefore ship in a vulnerable state.

Attack Vector

An attacker sends an unauthenticated HTTPS request to the Parse cloud function endpoint, supplying a target document identifier. Document identifiers are Parse objectId values, which are short and enumerable. The server responds with the complete document record and a working pre-signed download URL. No credentials, session tokens, or user interaction are required.

See the OpenSign project repository for the affected function implementation and remediation status.

Detection Methods for CVE-2026-72689

Indicators of Compromise

Unauthenticated POST requests to /functions/getDocument or the equivalent Parse cloud function route
Elevated volume of getDocument calls originating from a single source address or user agent
Outbound access to object storage pre-signed URLs from IP addresses not associated with legitimate signers
Web server logs showing getDocument responses containing signer email addresses returned to anonymous sessions

Detection Strategies

Inspect Parse Server logs for getDocument invocations lacking a sessionToken or X-Parse-Session-Token header
Alert when a single client requests multiple sequential document objectId values within a short window, which indicates enumeration
Correlate Parse cloud function calls with downstream pre-signed URL fetches to identify bulk exfiltration patterns

Monitoring Recommendations

Ingest Parse Server and reverse proxy access logs into a centralized analytics platform for anomaly detection
Track the rate of anonymous versus authenticated getDocument requests as a baseline metric
Monitor object storage access logs for pre-signed URL redemptions from geographies inconsistent with signer records

How to Mitigate CVE-2026-72689

Immediate Actions Required

Upgrade opensignserver to a fixed release once published by OpenSignLabs and monitor the OpenSign repository for advisories
Set IsEnableOTP to true on all existing documents to force OTP verification before disclosure
Restrict network exposure of the Parse Server API to trusted origins using a reverse proxy or web application firewall (WAF)
Rotate any pre-signed URLs and object storage credentials that may have been retrieved by unauthorized parties

Patch Information

At the time of NVD publication, no fixed version is listed. Track the OpenSign project repository for a release beyond 2.37.0 that removes useMasterKey from the getDocument cloud function and enforces per-caller ACL checks.

Workarounds

Modify the getDocument cloud function to remove useMasterKey: true and rely on the caller's session ACL
Enforce OTP verification by defaulting IsEnableOTP to true in application configuration and for all historical records
Place the Parse Server endpoint behind an authenticating gateway that rejects anonymous requests to /functions/getDocument
Shorten object storage pre-signed URL lifetimes to reduce the window in which leaked URLs remain usable

bash

# Configuration example: block unauthenticated getDocument calls at the reverse proxy (nginx)
location = /parse/functions/getDocument {
    if ($http_x_parse_session_token = "") {
        return 401;
    }
    proxy_pass http://opensignserver_upstream;
}