Opensignserver
Approved changes feed: RSS · Atom
cpe:2.3:a:opensignlabs:opensignserver:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Opensignlabs (7a5cdf35-da90-5582-9bb2-39741dce715f) |
|---|---|
| Product | Opensignserver (d9560d5d-dca9-5aa4-a99b-403dadf9230f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-72688 |
vulnerable | 2026-09-16 04:33:09.245709 |
OpenSignLabs opensignserver - Missing Authentication for Critical Function
HIGH (7.5)
A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.
Published: 2026-08-10T11:59:02.770Z
Updated: 2026-08-10T18:22:30.882Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-72691 |
vulnerable | 2026-09-16 04:33:09.138049 |
OpenSignLabs opensignserver - Authentication Bypass
HIGH (7.5)
An authentication bypass vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to mint MASTER_KEY-signed file access tokens for arbitrary stored files via the getsignedurl Parse cloud function. The function skips its isAuthenticated check whenever any docId parameter is supplied, even one corresponding to no real document, allowing the authentication gate to be bypassed by supplying an arbitrary string as docId.
Published: 2026-08-10T11:59:11.981Z
Updated: 2026-08-10T18:22:08.110Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-72689 |
vulnerable | 2026-09-16 04:33:09.073960 |
OpenSignLabs opensignserver - Broken Object Level Authorization
HIGH (7.5)
A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the document's IsEnableOTP flag is unset, which is the default configuration.
Published: 2026-08-10T11:59:05.984Z
Updated: 2026-08-10T18:22:23.869Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-72692 |
vulnerable | 2026-09-16 04:33:08.309052 |
OpenSignLabs opensignserver - Missing Authorization
HIGH (7.5)
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.
Published: 2026-08-10T11:59:14.935Z
Updated: 2026-08-10T18:21:58.204Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.