OpenSign CVE-2026-92794

Two concrete preconditions apply. First, one-time-password (OTP) verification must be disabled on the OpenSign server - the getDocument cloud function only skips caller-identity validation in that mode. Second, the attacker must supply a valid document identifier that originates from a guest signing link, so they need to have received/intercepted such a link or successfully enumerate an identifier. No account or authentication is required (PR:N), and no user interaction is needed. The limiting factors are therefore the non-default OTP-disabled configuration and possession of a document ID; impact is confined to disclosure of document details, signer information, sender identity, and download tokens (VC:H, no integrity or availability impact). Affected: OpenSign versions 0 through 2.41.3.

All signals point to a genuine but confidentiality-only exposure rather than a full-compromise emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC:H/VI:N/VA:N) describes remote, unauthenticated, low-complexity access with high confidentiality impact and no integrity or availability impact - consistent with CWE-862 Missing Authorization leading to information disclosure. Exploitation status is 'no public exploit identified at time of analysis': there is no CISA KEV listing and no POC flagged in the input, and no EPSS score was supplied, so probabilistic exploitation likelihood cannot be quantified. The one meaningful qualifier the raw score hides is a configuration precondition: the flaw is only reachable 'when one-time-password verification is disabled,' and the attacker must already possess a document identifier from guest signing links - so PR:N is technically correct (no login) but real exploitation is gated on a non-default-ish setting and on obtaining/guessing a valid document ID. The reporter is VulnCheck (a credible commercial intelligence source) with a specific vulnerable code reference (getDocument.js lines 20-32), which raises confidence in the technical claim. Net: a real, patch-worthy authorization bug that leaks sensitive document metadata and valid download tokens, but scoped to disclosure and conditioned on OTP being disabled - prioritize for OpenSign operators running that configuration, not a universal drop-everything item.

An unauthenticated attacker who has obtained a document identifier from a guest signing link (or can enumerate one) calls the getDocument cloud function against an OpenSign server that has OTP verification disabled. Because the function never validates caller identity, the server returns complete document details - all signers' personal information, sender identity, and valid download tokens - which the attacker then uses to retrieve the actual signed documents. No exploit code is published, but the vulnerable code path is publicly identified in the vendor issue (#2218) and source.