What is the CVSS score of CVE-2026-72544?

CVE-2026-72544 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of OpenSign are affected by CVE-2026-72544?

OpenSign deployments through version 2.37.0 are vulnerable to unauthenticated audit-trail manipulation that compromises the legal enforceability of digitally signed documents.

How to fix or mitigate CVE-2026-72544?

Within 24 hours, identify all OpenSign deployments and document their versions, then restrict network access to OpenSign instances to authorized users only (implement IP whitelisting or VPN requirement). Within 7 days, monitor all audit logs for suspicious entries and escalate any anomalies for forensic review, isolate any affected signing workflows from downstream systems pending review, and request an ETA from OpenSign for a patched version. Within 30 days, prepare to migrate to a patched version of OpenSign as soon as it becomes available, conduct a complete audit of all document signatures created during the vulnerability window to verify authenticity, and implement additional non-repudiation controls such as independent timestamp servers or third-party notarization where feasible.

OpenSign CVE-2026-72544

EUVD-2026-56014 HIGH

Insufficient Verification of Data Authenticity (CWE-345)

2026-08-11 TuranSec

GHSA-7j6v-hchx-rmq3

Information Disclosure Opensign Opensignlabs

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

7.5 HIGH

Network-callable Parse cloud function requires no authentication; impact is confined to integrity of audit records with no confidentiality or availability effect on the vulnerable system.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:07 vuln.today

CVE Published

Aug 11, 2026 - 11:09 cve.org

HIGH 7.5

DescriptionCVE.org

An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without authentication, allowing fabrication of arbitrary audit log entries. An attacker can tamper with the legal audit trail of any signed document, undermining non-repudiation.

AnalysisAI

OpenSign through version 2.37.0 exposes an unauthenticated remote integrity bypass in its document audit-trail mechanism, allowing any network-accessible attacker to fabricate arbitrary audit log entries by directly invoking the triggerevent Parse cloud function with caller-controlled viewer identity and IP address parameters. The vulnerability (CWE-345: Insufficient Verification of Data Authenticity) directly undermines non-repudiation in digitally signed documents, which is the legal and evidentiary foundation of electronic signature workflows. No public exploit has been identified at time of analysis, but the CVSS vector confirms the attack requires no authentication, no user interaction, and low complexity, making it trivially exploitable against any exposed OpenSign deployment.

Technical ContextAI

OpenSign is an open-source electronic document signing platform built on the Parse Platform backend-as-a-service framework. The vulnerability resides in the triggerevent Parse cloud function, which is responsible for recording audit-trail events such as document views, signings, and IP-based attribution for legal non-repudiation purposes. CWE-345 (Insufficient Verification of Data Authenticity) describes the root cause: the cloud function accepts caller-supplied parameters - including viewer identity and IP address - without enforcing authentication or performing any cryptographic verification of their legitimacy. Because Parse cloud functions are callable over HTTP without mandatory session context by default, the function treats all submitted parameters as trusted inputs. Affected versions span all releases through 2.37.0 per CPE identifier cpe:2.3:a:opensignlabs:opensign:*:*:*:*:*:*:*:* and ENISA tracking entry EUVD-2026-56014, which corroborates the version ceiling reported by TuranSec.

RemediationAI

No vendor-released patch has been identified at time of analysis - the only reference provided points to the upstream GitHub repository at https://github.com/OpenSignLabs/OpenSign, with no tagged patched release confirmed as of this writing. Operators should actively monitor that repository's releases and changelog for a fix that enforces authentication or server-side validation within the triggerevent cloud function. As an immediate compensating control, restrict network access to the Parse API endpoint at the firewall or reverse-proxy layer so that only authenticated internal services or known trusted IP ranges can invoke triggerevent; this eliminates unauthenticated external fabrication at the cost of reduced remote accessibility for legitimate audit-event clients. Alternatively, a Parse beforeSave or cloud middleware hook can be inserted to require a valid session token before triggerevent executes - this requires custom code modification but preserves full feature functionality. Organizations with legal or regulatory obligations tied to OpenSign audit trails should immediately assess whether existing audit logs may have been tampered with and consider suspending reliance on those logs for evidentiary purposes until the issue is remediated and logs can be validated or reconstructed.