opensignserver CVE-2026-72692

The CVSS vector PR:N confirms exploitation requires no authentication credentials. The attacker must have network reachability to the Parse API endpoint that hosts the declinedoc cloud function. The target document must be in an in-flight state - not yet completed, previously declined, or otherwise closed. The attacker must know or be able to discover a valid document object identifier. No non-default server configuration is required; the vulnerability exists in the standard declinedoc function implementation in all versions through 2.37.0. Exploitation is constrained by: the requirement to identify a valid in-flight document ID, and the need for network access to the Parse API port. There is no user interaction required and no authentication barrier.

The CVSS 3.1 score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) accurately reflects the exploitation ease: the attack is network-reachable, requires no credentials, no attack complexity, and no user interaction. The integrity impact is rated high because the forgery of the DeclineBy attribution field corrupts the legal evidentiary record of who declined a document, not merely the operational state. No EPSS data was supplied, and the absence of a CISA KEV entry and any public POC reference suggests exploitation has not been widespread - however, the trivially low barrier to exploitation means that even a mid-sized municipal IT team in zabrze relying on opensignserver for legally binding workflows should treat this as urgent remediation priority. The forgery dimension elevates real-world risk beyond operational disruption: a malicious actor can frame an innocent signatory for workflow interference. There are no conflicting signals between the CVSS vector and the technical description; both confirm unauthenticated, low-complexity network exploitation.

An unauthenticated attacker with network access to the Parse API identifies a valid in-flight document ID - through enumeration, social engineering, or insider access - and sends a crafted HTTP POST to the declinedoc cloud function endpoint, supplying a DeclineReason string and a DeclineBy pointer referencing an arbitrary user account. The server writes all fields to the document record without verifying the caller's identity, permanently terminating the signing workflow and producing a falsified audit trail that attributes the decline to the framed user.