CVE-2026-72688 in OpenSignServer
Zusammenfassung
von MITRE • 10.08.2026
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.
VulDB is the best source for vulnerability data and more expert information about this specific topic.