OpenSign CVE-2026-72549

No special conditions are required for exploitation - the getUserId Parse Cloud Function performs no authentication check and is accessible to any remote attacker over the network against default configurations of OpenSign through 2.37.0. The only requirement is network access to the Parse API endpoint (typically HTTP/HTTPS on the port OpenSign is deployed on). Exploitation is limited in impact to the disclosure of internal user objectIds; credentials, document content, and signing keys are not directly accessible through this function. Internet-facing deployments are at highest risk; instances restricted to internal networks reduce exposure but do not eliminate it. No specific non-default configuration is required to trigger the vulnerability.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects a low-complexity, unauthenticated network attack with limited confidentiality impact - internal user objectIds are exposed but no credentials, document content, or high-sensitivity data is directly returned. No EPSS data was provided in the intelligence, no POC exploit code has been identified, and the vulnerability does not appear in the CISA KEV catalog, indicating no confirmed active exploitation at time of analysis. Real-world risk depends on deployment context: organizations using OpenSign to handle sensitive contracts, legal agreements, or regulated documents face meaningful indirect risk, because the objectIds can seed enumeration attacks or identify high-value accounts for targeted phishing. The risk is elevated in internet-facing deployments relative to internal-only instances. The primary concern is its use as a reconnaissance primitive rather than as a standalone critical vulnerability - treat it as the first link in a potential attack chain rather than an isolated medium-severity finding.

An external attacker targeting an organization that uses OpenSign sends a series of HTTP POST requests to the publicly accessible /parse/functions/getUserId endpoint, supplying a list of corporate email addresses harvested from LinkedIn or leaked credential dumps. Each successful response returns the internal Parse objectId for that user. The attacker then uses the collected objectIds to identify accounts of executives or legal staff who routinely sign sensitive agreements, enabling targeted spear-phishing or attempts to exploit other authenticated API endpoints that accept objectIds as input parameters.