CVE-2026-92794 Overview
CVE-2026-92794 is an information disclosure vulnerability in OpenSign versions through 2.41.3. The flaw resides in the getDocument cloud function, which fails to validate caller identity when one-time-password (OTP) verification is disabled. An unauthenticated attacker who obtains a document identifier from a guest signing link can retrieve the full document record. Returned data includes all signers' information, sender identity, and valid download tokens. The issue is classified as Missing Authorization [CWE-862] and affects the OpenSign electronic signature platform maintained by OpenSignLabs.
Critical Impact
Unauthenticated attackers can enumerate document identifiers to exfiltrate signer personal data, sender identity, and download tokens without any credentials.
Affected Products
- OpenSign versions through 2.41.3
- OpenSignServer getDocument cloud function (apps/OpenSignServer/cloud/parsefunction/getDocument.js)
- Deployments where one-time-password verification is disabled
Discovery Timeline
- 2026-09-16 - CVE-2026-92794 published to the National Vulnerability Database (NVD)
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92794
Vulnerability Analysis
OpenSign exposes a Parse Server cloud function named getDocument used by both authenticated users and guest signers. When OTP verification is disabled, the function returns the full document record based solely on the supplied docId parameter. No check confirms that the caller is a signer, the sender, or an authenticated tenant user. An attacker who possesses or guesses a valid document identifier retrieves the same data as a legitimate recipient. Returned fields include signer names, email addresses, sender identity, document metadata, and download tokens that grant access to the signed PDF.
Root Cause
The root cause is missing authorization in the request handler. The function reads the docId argument and issues a database query without correlating the caller session with the document's authorized participants. When the OTP gate is not enabled, no compensating identity check exists. This design assumes that possession of a document identifier equates to authorization, which does not hold once identifiers leak through logs, URLs, referrers, or brute-force enumeration.
Attack Vector
Exploitation occurs over the network with no authentication and no user interaction. An attacker sends a crafted request to the OpenSign server invoking the getDocument cloud function with a target docId. The identifier can be harvested from prior guest signing links, screen captures, email forwards, or by enumerating identifier formats. The server responds with the complete document object, including download tokens that the attacker can replay to fetch the signed file.
Refer to the VulnCheck Advisory on OpenSign and the vulnerable source at getDocument.js lines 20-32 for the specific unguarded code path.
Detection Methods for CVE-2026-92794
Indicators of Compromise
- Unusual volume of Parse Server requests targeting the getDocument cloud function from a single client or IP range.
- Access to getDocument without a preceding OTP verification call in the same session.
- Sequential or high-entropy enumeration of docId values in application logs.
- Download token usage originating from IP addresses that do not match the recipient's historical geography.
Detection Strategies
- Review OpenSignServer application logs for getDocument invocations that return success responses with no authenticated session context.
- Correlate docId request patterns to identify enumeration behavior, such as many distinct identifiers requested by one source in a short window.
- Alert on requests to the cloud function that lack a prior OTP verification event when OTP is configured as required.
Monitoring Recommendations
- Enable verbose Parse Server request logging and forward events to a centralized analytics platform for retention and search.
- Monitor egress of download tokens and PDF retrievals for anomalous source addresses or user agents.
- Track the OTP enablement flag in configuration management to detect drift that reintroduces the vulnerable state.
How to Mitigate CVE-2026-92794
Immediate Actions Required
- Enable one-time-password verification for all guest signing flows to restore the identity check the getDocument function relies on.
- Rotate or invalidate outstanding document download tokens that may have been retrieved through the vulnerable path.
- Restrict inbound access to the OpenSignServer API to trusted networks or a web application firewall while a patched release is validated.
Patch Information
OpenSignLabs tracks remediation for this issue in GitHub Issue #2218. Operators should monitor the OpenSign repository for a release beyond 2.41.3 that adds caller identity validation to the getDocument cloud function and upgrade as soon as the fix is available.
Workarounds
- Keep OTP verification enabled for every document workflow; do not disable it for convenience or testing in production.
- Add a reverse-proxy or API gateway rule that requires a valid signer session cookie or OTP token before forwarding requests to the getDocument endpoint.
- Shorten download token lifetimes and bind tokens to the recipient's email or IP where the deployment supports it.
- Audit existing documents for exposure and notify affected signers if log analysis indicates unauthorized retrieval.
# Configuration example: require OTP verification in OpenSign environment
export ENABLE_OTP_VERIFICATION=true
# Restart the OpenSignServer service after applying the change
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
