OpenSignServer CVE-2026-72689

The getDocument Parse cloud function must be network-accessible, which is the standard deployment posture for any internet-facing or intranet OpenSignServer instance. The target document record's IsEnableOTP flag must be unset (false), which is the default configuration - meaning the overwhelming majority of documents on unpatched deployments are vulnerable without any special prerequisite. No authentication is required: the CVSS vector is PR:N/UI:N, confirmed by the description stating 'unauthenticated remote attacker.' The attacker must supply a valid document object ID; exploitability is therefore partially dependent on ID predictability or prior knowledge. The impact is strictly limited to confidentiality - attackers cannot modify or delete records through this vector (I:N, A:N). Deployments where IsEnableOTP has been explicitly set to true on all document records are not vulnerable through this specific path.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, score 7.5) accurately characterizes this vulnerability: unauthenticated, low-complexity, network-accessible access yielding high confidentiality impact with no integrity or availability consequence. There is no CISA KEV listing, no referenced POC code, and no EPSS score provided in the available data. Despite the absence of confirmed active exploitation, the practical risk is substantial: exploitation requires only knowledge of a target document object ID (potentially enumerable depending on ID generation), a network path to the Parse cloud function endpoint, and no credentials. Because the vulnerable code path triggers on the default configuration (IsEnableOTP=false), the entire user base running unpatched versions should be considered exposed. For a document-signing platform, confidentiality is the core security property - exposure of signed contract content and PII constitutes a material breach-class event. The absence of a KEV listing should not be interpreted as low risk; the attack surface is broad, the exploit is trivially simple, and the exposed data class is sensitive.

An unauthenticated external attacker identifies a publicly accessible OpenSignServer instance and submits a crafted request to the getDocument Parse cloud function, supplying a target document object ID obtained through enumeration or prior reconnaissance. Because the function invokes useMasterKey internally and the document's IsEnableOTP flag is false (the default), the server responds with the complete contract record including sender and signer names, contact details, and a pre-signed download URL - granting the attacker full access to the signed document without presenting any credentials.