EUVD-2026-56018
GHSA-5w47-3cxw-fxxf
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible unauthenticated read-only endpoint; only confidentiality is impacted as gettenant performs no writes and scope does not change.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
2DescriptionCVE.org
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.
AnalysisAI
Information disclosure in OpenSignLabs OpenSign through 2.37.0 exposes complete organisation tenant records to unauthenticated remote attackers via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant configuration record without any authentication or authorization check, enabling systematic enumeration of all tenant data across a multi-tenant deployment. No public exploit has been identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) means no specialised tooling is required.
Technical ContextAI
OpenSign is an open-source electronic document signing platform built on the Parse Platform, a Node.js backend-as-a-service framework that exposes server-side logic as Cloud Functions invokable over HTTP. The gettenant Cloud Function is intended to retrieve organisation tenant configuration by contactId. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the function performs no session validation, role check, or ownership verification before returning the full tenant record to the caller. The affected product is identified by CPE cpe:2.3:a:opensignlabs:opensign:*:*:*:*:*:*:*:*, covering all versions through 2.37.0 per EUVD-2026-56018. Parse Platform does support beforeFind triggers and cloud function hooks that can enforce authentication, but this protection was not implemented for gettenant.
RemediationAI
Upgrade OpenSign to a version above 2.37.0 once a patched release is published by OpenSignLabs - the provided references point only to the GitHub repository at https://github.com/OpenSignLabs/OpenSign, and no specific fix version has been confirmed in the available data; monitor the repository's releases and commit history for a remediation commit. As a compensating control prior to patching, restrict network access to the Parse API endpoint at the perimeter or API gateway layer so that only authenticated sessions can reach Cloud Function endpoints; this avoids the need for code changes but may impact legitimate unauthenticated flows. Alternatively, a Parse beforeFind hook or cloud function middleware can be added to gettenant to validate the caller's session token and organisation membership before returning data - this is a targeted code-level fix but requires access to the application source and redeployment. If the instance is publicly exposed, consider temporarily disabling or blocking the gettenant endpoint until a vendor patch is available, accepting that tenant-lookup flows dependent on this function will break.
Unauthenticated contact record enumeration in OpenSignLabs OpenSign through 2.37.0 exposes all stored personally identif
Unauthenticated remote write to any contact record is possible in OpenSignLabs OpenSign through version 2.37.0 via the u
OpenSign through version 2.37.0 exposes an unauthenticated remote integrity bypass in its document audit-trail mechanism
Unauthenticated user enumeration in OpenSignLabs OpenSign through 2.37.0 exposes internal user objectIds via the getUser
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today