CVE-2026-72548 in OpenSign
Summary
by MITRE • 08/11/2026
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical information disclosure flaw in OpenSignLabs OpenSign platform version 2.37.0 and earlier, where the gettenant Parse cloud function fails to implement proper authentication and authorization controls. The flaw resides in the Parse cloud function implementation that accepts a contactId parameter without validating the requestor's credentials or permissions, creating an unauthorized access vector that allows remote attackers to retrieve complete tenant records from any organization within the system. This represents a direct violation of the principle of least privilege and demonstrates a fundamental failure in the application's access control mechanisms.
The technical exploitation of this vulnerability occurs through a simple API call that leverages the contactId parameter to bypass authentication requirements entirely. Attackers can enumerate tenant records by systematically providing different contactId values, resulting in exposure of sensitive configuration data including organizational structures, user mappings, and potentially system settings that should remain confidential. This type of vulnerability is classified as CWE-284 Access Control Bypass and aligns with ATT&CK technique T1566 Credential Stuffing and T1071.004 Application Layer Protocol: DNS, as it enables unauthorized data retrieval through legitimate application interfaces.
The operational impact extends beyond simple data exposure, as the disclosed tenant configuration information can serve as a foundation for more sophisticated attacks including social engineering campaigns, targeted phishing attempts, and privilege escalation within the system. Organizations may inadvertently expose sensitive metadata about their infrastructure, user base, and operational procedures that could be leveraged by malicious actors to plan further infiltration attempts. The vulnerability's remote and unauthenticated nature means that attackers can exploit it from anywhere on the internet without requiring any prior access credentials or system compromises.
Mitigation strategies should focus on implementing robust authentication and authorization checks at the Parse cloud function level, requiring proper API key validation or session tokens before allowing tenant record retrieval operations. Organizations should also implement rate limiting and monitoring controls to detect anomalous enumeration patterns that may indicate exploitation attempts. The fix should include mandatory parameter validation, access control verification, and comprehensive logging of all tenant record access attempts. Additionally, regular security assessments should be conducted to identify similar authorization bypass vulnerabilities within the application's cloud function architecture. This vulnerability underscores the importance of implementing defense-in-depth strategies and demonstrates how seemingly minor access control oversights can create significant security risks in cloud-based applications.