OpenSignServer CVE-2026-72688

No special conditions are required for exploitation against default deployments. The fileupload Parse cloud function is present and exposed in all versions through 2.37.0 without any authentication gating. The CVSS vector PR:N confirms no privileges are required. Exploitation is bounded only by network accessibility: instances that restrict external access to the Parse cloud function endpoint (e.g., behind a private VPN or firewall with no public exposure) are not directly reachable from untrusted networks. No non-default configuration, specific feature flag, or special platform is required - the vulnerable function exists and is unauthenticated in the default server deployment.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N accurately captures the exploitation profile: the attack is network-reachable, trivially triggered, requires no authentication or user interaction, and results in full read access to all stored contract documents. EPSS data was not included in the provided intelligence, so quantitative exploitation probability cannot be assessed. No CISA KEV listing has been identified and no public POC has been reported at time of analysis - however, the absence of KEV status should not reduce organizational urgency, since the mechanism requires nothing beyond an HTTP client and knowledge of the endpoint path. Any organization relying on opensignserver for sensitive contract storage should treat this as a high-priority remediation item; the attack requires no specialized tooling and confidential contracts represent a high-value target for both targeted and opportunistic actors. The only realistic limiting factor is network exposure: instances firewalled from untrusted networks are not directly reachable.

An unauthenticated attacker sends an HTTP POST request to the publicly accessible opensignserver Parse cloud function endpoint targeting the fileupload function, supplying a URL referencing a stored contract document. The server returns a MASTER_KEY-signed access token, which the attacker uses to directly retrieve the document contents. No credentials, prior account registration, or knowledge beyond the server hostname and function path are required.