CVE-2026-72549 in OpenSign
Summary
by MITRE • 08/11/2026
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can use this to enumerate user accounts and target subsequent attacks.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical information disclosure flaw in OpenSignLabs OpenSign platform version 2.37.0 and earlier, where the getUserId Parse cloud function lacks proper authentication mechanisms. The flaw resides in the application's user account enumeration process, allowing unauthenticated remote attackers to systematically map external identifiers such as email addresses or usernames to internal system objectIds. This type of vulnerability falls under CWE-200 - Information Exposure and aligns with ATT&CK technique T1087.001 - Account Discovery, where adversaries seek to understand the target environment's user structure. The Parse cloud function serves as an entry point for attackers to discover valid user accounts within the system without requiring any credentials or authorization.
The technical implementation of this vulnerability demonstrates a fundamental security oversight in the platform's access control design. When an attacker sends a request to the getUserId endpoint, the system resolves and returns the internal ObjectId associated with the provided email address or username without verifying the requester's authentication status. This behavior creates a direct mapping between external user identifiers and internal system references, effectively providing attackers with a comprehensive list of valid accounts within the platform. The vulnerability essentially transforms the platform's user management system into an account enumeration service that operates without any access restrictions, making it particularly dangerous for threat actors seeking to target specific users or conduct broader reconnaissance activities.
The operational impact of this vulnerability extends beyond simple information disclosure, creating significant risks for the platform's security posture and user privacy. Attackers can leverage this flaw to perform systematic user enumeration across the entire user base, potentially identifying high-value targets such as administrators or users with elevated privileges. This enumeration capability enables more sophisticated attacks including targeted phishing campaigns, credential stuffing attacks against known user accounts, or social engineering attempts that exploit the discovered user information. The vulnerability also undermines the platform's ability to maintain user confidentiality and can facilitate further exploitation attempts where attackers use the mapped user identities to plan more precise attack vectors. Organizations using this vulnerable version may experience compromised user privacy, increased risk of account takeovers, and potential regulatory compliance violations due to unauthorized data access.
Organizations should immediately implement mitigations including authentication enforcement for all cloud function endpoints, particularly those handling user identification and account management operations. The most effective immediate fix involves requiring proper authentication tokens or API keys before executing the getUserId function, ensuring that only authorized users can access user mapping capabilities. Additionally, implementing rate limiting and request monitoring for these functions helps detect and prevent automated enumeration attempts. Organizations should also consider implementing account lockout mechanisms and anomaly detection systems to identify suspicious activity patterns. From a defensive perspective, this vulnerability highlights the importance of proper input validation and authentication checks in cloud-based applications, aligning with NIST SP 800-53 security controls that emphasize access control and audit logging. The platform should also implement proper error handling that does not reveal internal system information to unauthorized users, reducing the attack surface and preventing additional information leakage that could aid in further exploitation attempts.