EUVD-2026-56015
GHSA-4vpg-x7mh-3947
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Network-exposed Parse endpoint requires no credentials; only integrity is impacted as attackers overwrite contact data with no confidentiality or availability consequence.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target contact record. An attacker can corrupt or overwrite contact data for any user in the system without credentials.
AnalysisAI
Unauthenticated remote write to any contact record is possible in OpenSignLabs OpenSign through version 2.37.0 via the updatecontacttour Parse cloud function, which performs no authentication or authorization checks before accepting and applying updates to arbitrary contact records. Any internet-reachable deployment is vulnerable to data corruption or overwrite of contact records for all users system-wide without credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, though the vulnerability's zero-prerequisites nature and straightforward exploitation model make it a realistic target for automated abuse.
Technical ContextAI
OpenSign is an open-source electronic signature platform built on the Parse Platform, which provides a cloud function execution model where server-side functions (cloud functions) can be exposed over HTTP. The vulnerable function, updatecontacttour, is a Parse cloud function that directly identifies and updates a target contact record by an externally supplied reference - the canonical definition of an Insecure Direct Object Reference (CWE-639: Authorization Through User-Controlled Key). The root cause is the complete absence of session validation or permission checks within the cloud function handler: the function trusts the caller-supplied record identifier and applies the update without verifying whether the caller owns or is authorized to modify the referenced record. The CPE string cpe:2.3:a:opensignlabs:opensign:*:*:*:*:*:*:*:* confirms the entire OpenSign application product line from OpenSignLabs is within scope, across all versions up to and including 2.37.0.
RemediationAI
Upgrade OpenSign to a version beyond 2.37.0 if one has been released; however, a specific patched release version is not independently confirmed by the available reference data - the only reference provided points to the upstream GitHub repository (https://github.com/OpenSignLabs/OpenSign) rather than a tagged release or advisory. Operators should inspect the repository for commits or releases published after 2.37.0 that address the updatecontacttour cloud function. As a compensating control where immediate upgrade is not possible, restrict network-level access to the Parse cloud function endpoint (typically /parse/functions/updatecontacttour) via reverse proxy ACL or firewall rules, limiting calls to authenticated application sessions or internal networks only - this eliminates the unauthenticated network attack surface without requiring application changes, though it may break legitimate client functionality if the function is called from external clients. Additionally, audit contact record modification logs for unexpected changes as an indicator of prior exploitation. No vendor-released patch version is independently confirmed from the provided data.
Information disclosure in OpenSignLabs OpenSign through 2.37.0 exposes complete organisation tenant records to unauthent
Unauthenticated contact record enumeration in OpenSignLabs OpenSign through 2.37.0 exposes all stored personally identif
OpenSign through version 2.37.0 exposes an unauthenticated remote integrity bypass in its document audit-trail mechanism
Unauthenticated user enumeration in OpenSignLabs OpenSign through 2.37.0 exposes internal user objectIds via the getUser
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today