OpenSign CVE-2026-72544

No special conditions are required for exploitation against default OpenSign deployments through 2.37.0 - the triggerevent Parse cloud function is callable by unauthenticated remote clients by design, and the vulnerability exists in all standard deployment configurations. The attacker must have network access to the OpenSign server's Parse API endpoint (typically HTTPS on port 443 or the default Parse port) and must know or enumerate a target document identifier to inject forged events into a specific document's audit trail. Per the CVSS vector PR:N, no authentication, session token, or elevated privileges are required. Exploitation is bounded in scope: an attacker cannot use this vector alone to exfiltrate document contents, alter the cryptographically signed document artifact itself, or cause service unavailability. Self-hosted deployments with firewall restrictions limiting Parse API access to internal networks or specific client IP ranges would materially reduce the exploitable attack surface.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N accurately reflects the attack surface: network-reachable, low complexity, no authentication required, no user interaction needed, with a high integrity impact confined to the vulnerable system. The absence of EPSS data in the provided intelligence prevents probabilistic exploitation forecasting, and OpenSign is not currently listed in the CISA KEV catalog, suggesting no confirmed widespread active exploitation at time of writing. However, the trivially low exploitation barrier - a single unauthenticated HTTP request - means that even a mid-sized municipal IT team in kalisz relying on OpenSign for legally binding document workflows should treat this as urgent, regardless of the lack of KEV status. The practical business impact is severe for any organization using OpenSign for compliance or legal e-signature purposes: corrupted audit trails could invalidate document enforceability and expose organizations to legal challenges around authenticity and non-repudiation. No POC has been publicly identified, but the vulnerability description is detailed enough that exploitation requires no specialized knowledge. The high-integrity, no-confidentiality-impact profile is consistent with a data fabrication class of vulnerability rather than data exfiltration, which may reduce perceived urgency but not actual legal exposure.

An attacker with network access to an OpenSign deployment sends a crafted HTTP POST request directly to the triggerevent Parse cloud function endpoint, supplying arbitrary values for viewer identity and IP address fields of a target document they wish to corrupt. The function processes the request without validating the caller's session or verifying parameter authenticity, writing the fabricated entry into the document's legally binding audit trail. No public exploit code has been identified at time of analysis, but exploitation requires only knowledge of the Parse cloud function API surface and a target document identifier, making the attack feasible without specialized tooling.