OpenSign CVE-2026-72548

The gettenant Parse cloud function must be network-reachable, which is the default deployment posture for OpenSign instances. No authentication, session token, API key, or organisation membership is required - the CVSS vector PR:N/UI:N confirms fully unauthenticated, no-interaction exploitation. The attacker must supply a valid or enumerable contactId value; if contactIds are random UUIDs not exposed through other channels, blind enumeration is impractical, but if they are sequential or leaked via other application flows (e.g., invitation emails, public profile URLs), enumeration becomes trivial. Exploitation is not limited by operating system or deployment platform. The primary factor limiting exploitation scale is contactId predictability - this is the only realistic barrier and should be assessed per deployment.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately reflects the attack profile: network-reachable, zero authentication, zero user interaction, high confidentiality impact, no integrity or availability dimension. No EPSS score or CISA KEV listing was provided in the source data, so exploitation probability and active exploitation status are unknown. The absence of a KEV listing and lack of known POC tempers urgency, but the extremely low attack complexity makes this a straightforward mass-enumeration target once discovered. Scope is unscoped (S:U), so the blast radius is bounded to the OpenSign instance, but tenant configuration records in a document-signing platform commonly contain contact details, integration credentials, branding secrets, or SSO configuration whose sensitivity can be significant. The signal conflict to note: no EPSS data is available to cross-validate the CVSS-implied risk, and no vendor advisory has confirmed the exact data fields returned by gettenant, so the true sensitivity of disclosed records requires operator-level verification.

An unauthenticated attacker sends an HTTP POST request to the OpenSign Parse API endpoint invoking the gettenant cloud function with a valid or guessed contactId value. The function returns the full tenant record with no credential check; the attacker then iterates through contactId values - which may be sequential integers or predictable identifiers - to enumerate and exfiltrate configuration data for every organisation hosted on the instance. No public exploit code has been identified at time of analysis, but the attack requires only a standard HTTP client.