CVE-2026-72692 in OpenSignServer
Summary
by MITRE • 08/10/2026
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/10/2026
This vulnerability represents a critical authorization flaw in OpenSignLabs opensignserver version 2.37.0 and earlier, where an unauthenticated attacker can manipulate document workflow states without proper authentication mechanisms. The issue stems from the declinedoc Parse cloud function which processes document decline requests without validating caller identity or permissions. This missing authorization check creates a pathway for malicious actors to manipulate document processing workflows by submitting forged decline requests that appear to originate from legitimate users.
The technical implementation of this vulnerability allows attackers to supply arbitrary values for the DeclineBy parameter while the system accepts these inputs without verification. The function directly writes IsDeclined, DeclineReason, and the caller-supplied DeclineBy pointer into the document record without authentication checks or access control validation. This design flaw enables unauthorized modification of document state information and can be exploited to terminate legitimate workflow processes while simultaneously creating false attribution records that implicate innocent parties.
From an operational impact perspective, this vulnerability compromises both document integrity and audit trail reliability within the opensignserver platform. Attackers can not only halt document processing but also manipulate evidentiary records by attributing declines to arbitrary users, potentially causing reputational damage, legal complications, and workflow disruptions for legitimate users. The irreversible nature of these modifications means that once a document has been compromised, the false decline records cannot be easily corrected or reverted.
Security professionals should note this vulnerability aligns with CWE-863 (Authorization Bypass Through User-Controlled Key) and represents a significant risk under ATT&CK technique T1566 (Phishing) and T1499 (Endpoint Tampering). The missing authorization check creates an attack surface that can be exploited by remote unauthenticated actors, making it particularly dangerous for environments where document workflow integrity is critical. Organizations should implement immediate mitigations including authentication enforcement for all document manipulation functions, input validation for caller identity parameters, and mandatory access controls on workflow modification endpoints.
Recommended defensive measures include enforcing strict authentication requirements for all Parse cloud functions that modify document state, implementing robust input sanitization for all user-supplied parameters, and establishing comprehensive logging of document workflow changes with associated user identifiers. Additionally, organizations should conduct thorough security assessments of all cloud function endpoints to identify similar authorization gaps and ensure proper access control mechanisms are implemented throughout the application architecture. The vulnerability demonstrates the critical importance of validating caller identity at every point where system state modifications occur, particularly in document management and workflow processing systems where audit integrity is paramount for compliance and operational effectiveness.