OpenSign CVE-2026-72545

No special conditions are required for exploitation. The CVSS vector AV:N/AC:L/PR:N/UI:N confirms remote unauthenticated exploitation against any network-reachable deployment of OpenSign through 2.37.0 running in its default configuration. The only limiting factor is knowledge of a valid Parse object ID for a contact record - these IDs may be exposed through other API endpoints, embedded in signed document links, or enumerable through the application's normal workflow. Exploitation is limited to integrity impact (contact data overwrite); confidentiality of contact data is not directly exposed by this specific function, and service availability is not affected. The attack does not require any account, session token, or elevated privilege.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N scores 7.5 (High) and accurately characterizes the attack surface: network-accessible, low complexity, no privileges or user interaction required, with High integrity impact. The absence of confidentiality or availability impact bounds the score but does not diminish real-world impact - an attacker who can overwrite contact records for any user can corrupt signer identity data, tamper with agreement audit trails, or disrupt business workflows. EPSS data was not provided in the intelligence feed, so statistical exploitation probability cannot be quantified; however, the CVSS metrics (AV:N/AC:L/PR:N/UI:N) place this among the most automatable vulnerability classes - a single crafted HTTP request with a guessed or enumerated record identifier is sufficient to exploit. No CISA KEV listing exists at time of analysis, and no POC code was identified in the available references. The TuranSec attribution and ENISA EUVD listing (EUVD-2026-56015) confirm the finding has been reviewed by external researchers. Given the straightforward nature of the exploitation, the absence of KEV should not be taken as evidence of low attacker interest - IDOR vulnerabilities are frequently exploited quietly and may not surface in KEV until after widespread abuse is observed.

An unauthenticated attacker enumerates or guesses Parse object IDs for contact records - IDs that may be exposed via other API responses or predictable in format - and sends a crafted HTTP POST to the /parse/functions/updatecontacttour endpoint with the target record ID and arbitrary field values. The server applies the update without any credential or ownership check, overwriting the victim contact's data. No public proof-of-concept code has been identified at time of analysis, but the attack requires no special tooling beyond a standard HTTP client.