What is the CVSS score of EUVD-2026-56013?

EUVD-2026-56013 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.5%.

Which versions of OpenSign are affected by EUVD-2026-56013?

OpenSignLabs OpenSign versions through 2.37.0 allow unauthenticated remote access to all stored customer contact records and personally identifiable information.

How to fix or mitigate EUVD-2026-56013?

Within 24 hours: audit all systems for OpenSignLabs OpenSign deployments, document affected versions, and identify the scope of contact records at risk. Within 7 days: implement interim access controls including network-layer restrictions to the vulnerable Parse cloud backend, enable comprehensive API access logging on the getcontact function with alerting on enumeration patterns, and evaluate disabling the function if business requirements permit. Within 30 days: apply vendor patch to OpenSign when released, or if unavailable, deploy persistent compensating controls such as reverse-proxy authentication gates, Web Application Firewall rules blocking unauthenticated getcontact requests, or database-level encryption of PII fields.

OpenSign EUVD-2026-56013

| CVE-2026-72543 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-11 TuranSec

GHSA-89m8-qpv9-7q8g

Authentication Bypass Opensign Opensignlabs

7.5

CVSS 3.1 · Vendor: TuranSec

Severity by source

Vendor (TuranSec) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-callable with no credentials (PR:N, AV:N), trivial enumeration (AC:L), pure data disclosure with no write or availability impact (C:H/I:N/A:N).

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (TuranSec).

CVSS VectorVendor: TuranSec

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 12:06 vuln.today

CVE Published

Aug 11, 2026 - 11:08 cve.org

HIGH 7.5

DescriptionCVE.org

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks before returning the requested contact object. An attacker can enumerate and read all contact records including personally identifiable information without credentials.

AnalysisAI

Unauthenticated contact record enumeration in OpenSignLabs OpenSign through 2.37.0 exposes all stored personally identifiable information to remote attackers without credentials. The getcontact Parse cloud function executes with useMasterKey, which bypasses Parse Server's native access control layers (ACLs and Class-Level Permissions), and contains no compensating authentication or authorization logic. Any network-reachable attacker can call this function, supply arbitrary object IDs, and retrieve full contact records including PII at scale. No public exploit has been identified at time of analysis, and no KEV listing exists.

Technical ContextAI

OpenSign (cpe:2.3:a:opensignlabs:opensign:*:*:*:*:*:*:*:*) is an open-source electronic signature platform built on the Parse Platform (parse-server). The getcontact cloud function is a server-side Parse Cloud Code handler. When a Parse cloud function executes with useMasterKey: true, it operates with superuser privileges that bypass all Object-Level and Class-Level Permissions enforced by the Parse Server framework. The vulnerability is classified as CWE-639 (Authorization Through User-Controlled Key / Insecure Direct Object Reference): the function accepts a caller-supplied contact identifier, fetches the corresponding record with master-key authority, and returns it without verifying whether the caller has any right to access that object. This design conflates privileged internal data access with an externally exposed API endpoint, a pattern that breaks the parse-server security model entirely.

RemediationAI

No vendor-released patch with a confirmed fixed version was identified at time of analysis - the sole reference points to the upstream GitHub repository without linking to a specific advisory, tagged release, or commit fixing this issue. Deployers should monitor https://github.com/OpenSignLabs/OpenSign for a patched release and upgrade immediately upon availability. As an immediate compensating control, operators should restrict network access to the Parse cloud function endpoint (typically /parse/functions/getcontact) at the reverse-proxy or firewall layer, limiting callers to authenticated sessions or trusted internal services only - note that this may break legitimate workflows if any front-end feature depends on unauthenticated access to this function. A second compensating control is to patch the cloud function code directly by adding a request.user existence check and session token validation at the top of the getcontact handler, rejecting any invocation without a valid authenticated Parse session. Organizations should also audit logs for historical calls to this endpoint to assess whether unauthorized enumeration has already occurred.