What is the CVSS score of EUVD-2026-55524?

EUVD-2026-55524 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of OpenSignServer are affected by EUVD-2026-55524?

OpenSignLabs OpenSignServer (versions ≤2.37.0) contains a critical authorization bypass that exposes sensitive contract data-including customer personally identifiable information and downloadable…

How to fix or mitigate EUVD-2026-55524?

Within 24 hours, inventory all OpenSignLabs OpenSignServer instances (≤v2.37.0) and assess which contain sensitive customer or transaction data; enable the IsEnableOTP flag on all sensitive document collections as an interim control and immediately audit API logs for the past 30 days to detect unauthorized access. Within 7 days, restrict network access to the Parse cloud function endpoint using firewalls or WAF rules, complete a forensic analysis of document access patterns to identify potential breach scope, and establish incident response communication templates for affected customers pending findings. Within 30 days, monitor OpenSignLabs security advisories for patch availability and deploy immediately upon release; if no patch is available within 60 days, develop a vendor replacement plan or implement permanent network isolation.

OpenSignServer EUVD-2026-55524

| CVE-2026-72689 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-10 TuranSec

GHSA-mgm4-2355-58g4

Authentication Bypass Opensignserver Opensignlabs

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-accessible unauthenticated Parse cloud function call; only high confidentiality loss via full record disclosure, no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 10, 2026 - 12:52 vuln.today

CVE Published

Aug 10, 2026 - 11:59 cve.org

HIGH 7.5

DescriptionCVE.org

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the document's IsEnableOTP flag is unset, which is the default configuration.

AnalysisAI

Broken object-level authorization in OpenSignLabs OpenSignServer through 2.37.0 exposes complete contract records - including sender and signer PII and pre-signed document download URLs - to unauthenticated remote attackers via the getDocument Parse cloud function. The function internally calls useMasterKey, bypassing Parse's ACL enforcement, and returns full records whenever the document's IsEnableOTP flag is false, which is the default configuration across all deployments. No public exploit has been identified at time of analysis, but the network-accessible, zero-authentication attack path against default configurations makes this a high-priority data protection issue, particularly for organizations subject to GDPR or similar data regulation.

Technical ContextAI

OpenSignServer is an open-source electronic document signing platform built on the Parse Platform backend framework. Parse enforces access control via object-level ACLs that restrict which authenticated users or roles can read or write a given record. However, Parse also exposes a useMasterKey privilege escalation mechanism intended for trusted internal server-side operations - when invoked, it bypasses all ACL checks entirely. The getDocument cloud function misuses this mechanism by querying documents with useMasterKey without subsequently validating whether the requesting caller is authorized to receive the result. CWE-639 (Authorization Bypass Through User-Controlled Key) precisely describes this pattern: the attacker supplies a document object ID as the controlling key, and the server returns the associated record without any ownership or permission check. The IsEnableOTP flag, when set to true, introduces an additional challenge step that interrupts the unguarded return path; however, because it defaults to false, virtually all records in standard deployments are reachable. Affected products are identified by CPE cpe:2.3:a:opensignlabs:opensignserver:*:*:*:*:*:*:*:*.

RemediationAI

No vendor-released patch has been identified at time of analysis. Organizations should monitor the upstream repository at https://github.com/OpenSignLabs/OpenSign for a patched release and apply it as soon as available. As a compensating control, administrators can enforce IsEnableOTP=true on all existing and new document records, which disrupts the vulnerable return path; the trade-off is that all document access will then require OTP verification, changing the end-user experience. Alternatively, network-level controls - such as WAF rules or API gateway policies - blocking unauthenticated requests to the getDocument Parse cloud function endpoint can reduce external exposure with minimal operational impact, though this does not protect against insider or authenticated-user abuse of the same logic. Restricting the Parse API endpoint to trusted IP ranges is a higher-friction but effective control for deployments that do not require public internet access to document retrieval.