What is the CVSS score of CVE-2026-72688?

CVE-2026-72688 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of OpenSignServer are affected by CVE-2026-72688?

OpenSignLabs opensignserver through version 2.37.0 contains an unauthenticated remote access vulnerability allowing attackers to obtain a cryptographically-signed token that completely bypasses…

How to fix or mitigate CVE-2026-72688?

Within 24 hours: immediately identify all deployments of OpenSignLabs opensignserver through version 2.37.0, conduct an emergency classification audit of all stored contracts to identify sensitive business documents, and implement firewall or WAF rules to block external access to the fileupload endpoint. Within 7 days: deploy a reverse proxy with authentication in front of opensignserver, enable comprehensive audit logging on all file access requests, and prepare a contract exposure assessment for notification to relevant stakeholders per contractual and regulatory obligations. Within 30 days: either upgrade to a patched opensignserver release if available from the vendor, migrate to an alternative contract management platform with verified security controls, or implement application-layer request signing and token validation as a permanent mitigation, while maintaining enhanced monitoring and alerting for anomalous access patterns.

OpenSignServer CVE-2026-72688

EUVD-2026-55521 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-08-10 TuranSec

GHSA-jppp-j33j-6m5q

Authentication Bypass Opensignserver Opensignlabs

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network endpoint with no interaction needed; impact is read-only confidentiality with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 12:53 vuln.today

CVE Published

Aug 10, 2026 - 11:59 cve.org

HIGH 7.5

DescriptionCVE.org

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTER_KEY-signed file access tokens for any caller-supplied URL without performing any session check, defeating the only access control protecting stored contract files.

AnalysisAI

Unauthenticated remote access to all stored contract documents is possible in OpenSignLabs opensignserver through version 2.37.0 due to a missing authentication check in the fileupload Parse cloud function. Any unauthenticated attacker who can reach the endpoint can supply an arbitrary URL and receive a MASTER_KEY-signed file access token, completely defeating the only access control layer protecting stored documents. No public exploit has been identified at time of analysis, but the zero-privilege, low-complexity attack vector makes this highly accessible to unsophisticated threat actors.

Technical ContextAI

opensignserver is an open-source document signing and contract management platform developed by OpenSignLabs, built on the Parse Server framework. Parse Server uses a MASTER_KEY for administrative-level operations; cloud functions that mint tokens signed with this key bypass standard ACL-based access controls entirely. The vulnerable component, the fileupload Parse cloud function, accepts a caller-supplied URL and returns a MASTER_KEY-signed file access token without performing any session validation, identity check, or authorization verification. All versions through 2.37.0 are affected per CPE cpe:2.3:a:opensignlabs:opensignserver:*:*:*:*:*:*:*:*. The root cause is CWE-306 (Missing Authentication for Critical Function): a sensitive privileged operation - minting administrative access tokens - is exposed to unauthenticated callers as a public API endpoint.

RemediationAI

No vendor-released patched version has been identified at time of analysis. Organizations should monitor the project repository at https://github.com/OpenSignLabs/OpenSign for commits or releases addressing this issue. As an immediate compensating control, network-level access to the Parse cloud function endpoint should be restricted to authenticated internal networks or placed behind a reverse proxy that enforces session authentication before forwarding requests to the Parse API; note this may disrupt legitimate document workflows and requires testing. Additionally, deploying WAF rules that block unauthenticated requests to the /functions/fileupload endpoint can reduce exposure until a formal patch is released. If the fileupload function is not required for core operations, disabling or removing it from the server configuration is the most effective compensating control.