What is the CVSS score of CVE-2026-72692?

CVE-2026-72692 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of opensignserver are affected by CVE-2026-72692?

OpenSignLabs opensignserver through version 2.37.0 contains a missing authorization check that allows unauthenticated remote attackers to cancel any in-flight signing workflow and forge the decline…

How to fix or mitigate CVE-2026-72692?

Within 24 hours: Identify all systems running opensignserver versions up to 2.37.0 and review server audit logs for suspicious decline operations, focusing on DeclineBy field attribution anomalies and decline activity outside normal business hours. Within 7 days: Implement network-level restrictions on the declinedoc endpoint via firewall rules, enable comprehensive logging of all decline requests with alerting on anomalies, and contact OpenSignLabs for patch availability timeline and recommended interim mitigations. Within 30 days: Deploy the vendor patch to opensignserver immediately upon release; until patched, maintain access controls and establish a manual review process for all declined documents to detect forged decline records.

opensignserver CVE-2026-72692

EUVD-2026-55535 HIGH

Missing Authorization (CWE-862)

2026-08-10 TuranSec

GHSA-fm8m-9x77-qjvw

Authentication Bypass Opensignserver Opensignlabs

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

vuln.today AI

8.2 HIGH

PR:N confirmed by description and vector; A:L added over vendor's A:N because irreversible document decline constitutes partial availability loss to the signing workflow.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 12:51 vuln.today

CVE Published

Aug 10, 2026 - 11:59 cve.org

HIGH 7.5

DescriptionCVE.org

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.

AnalysisAI

Missing authorization in OpenSignLabs opensignserver through 2.37.0 lets unauthenticated remote attackers irreversibly decline any in-flight signing document and forge the decline attribution to an arbitrary user. The vulnerable declinedoc Parse cloud function writes the IsDeclined flag, DeclineReason text, and a caller-supplied DeclineBy pointer to the document record without verifying the caller's identity, enabling both workflow termination and evidentiary record falsification. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.

Technical ContextAI

OpenSignLabs opensignserver is a self-hosted electronic document signing platform built on the Parse Server framework, which exposes application logic as HTTP-accessible cloud functions. The defective component, declinedoc, is one such Parse cloud function that processes document decline operations. CWE-862 (Missing Authorization) identifies the root cause: the function accepts caller-supplied parameters including a DeclineBy pointer referencing an arbitrary user object, and writes all fields directly to the document record without first checking whether the caller is an authenticated participant or authorized actor in the signing workflow. The CPE cpe:2.3:a:opensignlabs:opensignserver:*:*:*:*:*:*:*:* confirms all versions through 2.37.0 are within scope. Because Parse Server cloud function endpoints are typically reachable over standard HTTPS, no special protocol access is required.

RemediationAI

No vendor-released patch version has been independently confirmed at the time of analysis. Operators should monitor https://github.com/OpenSignLabs/OpenSign for a patched release and upgrade as soon as one is published. As an immediate compensating control, restrict network access to the Parse API surface (typically port 443 or the configured Parse Server port) using a WAF or network-layer ACL so that only authenticated, known-good clients can reach cloud function endpoints - this reduces the unauthenticated exposure but requires careful scoping to avoid breaking legitimate client access. A more targeted application-layer mitigation is to add a Parse Server beforeFind or a function-level auth guard within the declinedoc cloud function to verify the caller's session token against the document's authorized participants before writing any fields; this change requires code modification and regression testing. Operators should audit existing document records for unexpected IsDeclined=true values or DeclineBy entries referencing users who would not logically have declined those documents, as this could reveal prior exploitation.