CVE-2026-72689 in OpenSignServer
Summary
by MITRE • 08/10/2026
A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the document's IsEnableOTP flag is unset, which is the default configuration.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical object-level authorization failure in the OpenSignLabs opensignserver application version 2.37.0 and earlier, where an unauthenticated remote attacker can access complete contract records without proper authentication or authorization. The flaw exists within the getDocument Parse cloud function which utilizes useMasterKey functionality to retrieve documents, effectively bypassing the standard Access Control List mechanisms that should protect sensitive data objects. This represents a direct violation of the principle of least privilege and demonstrates a fundamental breakdown in the application's authorization model.
The technical implementation of this vulnerability stems from the default configuration where the IsEnableOTP flag remains unset, which is the default state for new documents within the system. When this flag is not explicitly set, the getDocument function returns complete document records including sensitive personally identifiable information such as sender and signer details along with pre-signed document download URLs. This creates a scenario where any remote attacker can exploit this functionality without authentication to access potentially thousands of contract records containing confidential data. The useMasterKey parameter essentially acts as a backdoor that circumvents all standard authorization checks, making it particularly dangerous for applications handling sensitive documents.
The operational impact of this vulnerability is severe and multifaceted, affecting not only the confidentiality but also the integrity and availability of the system's document storage. Attackers can potentially access complete contract histories including personal information of individuals, business-sensitive data, and document metadata that could be used for identity theft, fraud, or corporate espionage. The pre-signed download URLs provide direct access to the actual document files, amplifying the potential damage significantly. This vulnerability affects organizations relying on the opensignserver platform for contract management, potentially exposing them to regulatory compliance violations under data protection frameworks such as gdpr, ccpa, and other privacy regulations that mandate strict control over personal data access.
This vulnerability aligns with CWE-285 (Improper Authorization) and represents a classic example of insufficient authorization checks where the system fails to properly validate access permissions before returning sensitive data. From an attack perspective, it maps to several ATT&CK techniques including T1078 (Valid Accounts), T1566 (Phishing), and T1041 (Exfiltration) as attackers could leverage this vulnerability to extract large volumes of sensitive information. The lack of authentication requirements for the getDocument function makes this particularly attractive to threat actors as it requires minimal effort to exploit, while providing maximum data access. Organizations should consider implementing proper input validation, enforcing mandatory authentication for all document retrieval functions, and ensuring that sensitive data is only returned when appropriate authorization checks are performed.
Mitigation strategies should include immediate implementation of mandatory authentication requirements for the getDocument function, enforcement of explicit access control lists even when using master keys, and configuration changes to require the IsEnableOTP flag to be explicitly set before allowing document retrieval. Organizations should also implement rate limiting and monitoring for unusual document access patterns, consider implementing data loss prevention measures, and conduct comprehensive audits of all cloud functions that handle sensitive data. Regular security testing and code reviews focusing on authorization logic are essential to prevent similar vulnerabilities in other components of the application stack, particularly those involving master key usage or bypass mechanisms that could be exploited by unauthorized parties.