OpenSign CVE-2026-72543

No special conditions are required - this is unauthenticated remote exploitation against any network-accessible OpenSign deployment running version 2.37.0 or earlier. The Parse cloud function endpoint is part of OpenSign's standard application surface; no non-default configuration, plugin, or feature flag needs to be enabled. Exploitation is limited only by network reachability to the Parse API endpoint (default port 1337 or via reverse proxy) and knowledge of the endpoint name getcontact. Self-hosted instances with the Parse API exposed only on internal networks have a reduced but non-zero risk from insider threats or network pivoting. Object ID enumeration is the only technical hurdle, and Parse object IDs are predictable enough (or brute-forceable) to make full database extraction realistic.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) accurately reflects the real-world risk profile: network-reachable, zero prerequisites, and high confidentiality impact. Attack complexity is genuinely low because the Parse cloud function interface is a standard, well-documented API endpoint - an attacker needs only an HTTP client and sequential or random object ID enumeration. No EPSS score was provided in the available intelligence data; given the absence of KEV listing and public exploit code, widespread automated scanning is not yet confirmed but cannot be ruled out given how trivial exploitation would be. The missing integrity and availability impact correctly scopes the risk to data theft, not system compromise. The primary real-world risk is mass extraction of contact PII - names, emails, phone numbers, and other fields stored during document signature workflows - which has direct GDPR, CCPA, and contractual liability implications for deploying organizations. The absence of KEV listing and POC reduces immediate urgency slightly, but the low exploitation barrier means this should be treated as a priority for any internet-exposed instance.

An external attacker identifies a publicly accessible OpenSign instance and calls the /parse/functions/getcontact HTTP endpoint without any session token or credentials, supplying a Parse object ID. The server executes the function with master-key privileges, returns the full contact record, and the attacker iterates over sequential or randomly generated object IDs to extract the entire contacts database including names, email addresses, and phone numbers. No public exploit code has been identified at time of analysis, but the exploitation technique requires only an HTTP client and knowledge of the Parse API format, both of which are publicly documented.