CVE-2026-72692: OpenSignLabs Auth Bypass Vulnerability

CVE-2026-72692 Overview

CVE-2026-72692 is a missing authorization vulnerability [CWE-862] affecting OpenSignLabs opensignserver through version 2.37.0. The flaw resides in the declinedoc Parse cloud function, which fails to verify the caller's identity before mutating document state. An unauthenticated remote attacker can decline any in-flight document and attribute the decline action to an arbitrary user. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without authorization checks. This enables workflow termination and evidentiary record falsification against any accessible document in the signing platform.

Critical Impact
Unauthenticated attackers can irreversibly terminate document signing workflows and forge decline attribution to arbitrary users, corrupting the integrity of audit records.

Affected Products

OpenSignLabs opensignserver through version 2.37.0
Deployments exposing the declinedoc Parse cloud function
OpenSign document signing platform instances

Discovery Timeline

2026-08-10 - CVE CVE-2026-72692 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-72692

Vulnerability Analysis

The vulnerability affects the declinedoc Parse cloud function in OpenSignLabs opensignserver. Parse cloud functions execute server-side logic invoked through the Parse Server API. The declinedoc function accepts parameters that mutate the state of a signing document. Specifically, it writes three fields: IsDeclined, DeclineReason, and DeclineBy.

The DeclineBy field stores a pointer to the user who declined the document. The function accepts this pointer directly from the caller without validating that the caller is authenticated. It also does not verify that the caller matches the identity supplied in DeclineBy. This allows attackers to forge the attribution on decline actions.

Because the function performs no authorization checks against session tokens or document access control lists, any network-reachable client can invoke it. The resulting state change is irreversible within the standard workflow, terminating the signature process for the targeted document.

Root Cause

The root cause is a missing authorization check [CWE-862] on a state-mutating cloud function. The declinedoc handler processes writes without validating the caller's session or verifying the caller has permission to act on the target document. It also trusts the client-supplied DeclineBy pointer without confirming it corresponds to the authenticated principal.

Attack Vector

Exploitation requires network access to the Parse Server endpoint hosting opensignserver. An attacker sends a crafted request to invoke the declinedoc cloud function with a target document identifier, an arbitrary DeclineReason, and a DeclineBy pointer referencing any user object. No authentication, user interaction, or elevated privileges are required. See the OpenSign Project repository for source-level context on the cloud function definition.

Detection Methods for CVE-2026-72692

Indicators of Compromise

Parse Server access logs containing calls to the declinedoc cloud function without a valid session token header
Documents transitioning to IsDeclined=true state with DeclineBy values that do not match any expected signer or recipient
Unexpected DeclineReason strings appearing on documents that were still in-flight
Spikes in decline events originating from a single IP address or user agent

Detection Strategies

Audit Parse Server request logs for declinedoc invocations lacking authenticated session context
Correlate DeclineBy user pointers against the document's authorized signer list to identify forged attributions
Alert when a single source generates decline events across multiple unrelated documents in a short window

Monitoring Recommendations

Enable verbose logging on Parse cloud function calls, including source IP, session token presence, and function parameters
Forward opensignserver and Parse Server logs to a centralized SIEM for retention and correlation
Establish baselines for legitimate decline volume and alert on statistical deviations

How to Mitigate CVE-2026-72692

Immediate Actions Required

Restrict network exposure of the Parse Server endpoint to trusted networks or place it behind an authenticating reverse proxy
Review historical declinedoc events for documents declined without a corresponding authenticated session
Notify document owners of any in-flight documents that were declined by unverified actors
Upgrade opensignserver to a version later than 2.37.0 once a patched release is available

Patch Information

At time of publication, no vendor-supplied patch identifier is referenced in the NVD entry. Monitor the OpenSign Project repository for a fixed release beyond version 2.37.0 that adds session validation and DeclineBy verification to the declinedoc cloud function.

Workarounds

Add a Parse Cloud Code beforeSave or wrapper trigger that rejects declinedoc calls when request.user is null
Enforce that the DeclineBy pointer on write must equal the authenticated request.user object identifier
Apply Parse Class-Level Permissions and per-object ACLs so document records cannot be modified without an authenticated session tied to an authorized signer

bash

# Configuration example: reject unauthenticated declinedoc invocations
# Add to OpenSign Parse Cloud Code before deploying
Parse.Cloud.beforeSave('contracts_Document', async (request) => {
  if (!request.user) {
    throw new Parse.Error(Parse.Error.INVALID_SESSION_TOKEN, 'Authentication required');
  }
  if (request.object.dirty('DeclineBy')) {
    const declineBy = request.object.get('DeclineBy');
    if (!declineBy || declineBy.id !== request.user.id) {
      throw new Parse.Error(Parse.Error.OPERATION_FORBIDDEN, 'DeclineBy must match caller');
    }
  }
});