EUVD-2026-56019
GHSA-8r4x-jw7g-pvfw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Network-accessible Parse function requires no authentication (PR:N, AV:N); only internal objectId disclosed, so C:L with no integrity or availability impact.
Primary rating from Vendor (TuranSec).
CVSS VectorVendor: TuranSec
Lifecycle Timeline
1DescriptionCVE.org
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can use this to enumerate user accounts and target subsequent attacks.
AnalysisAI
Unauthenticated user enumeration in OpenSignLabs OpenSign through 2.37.0 exposes internal user objectIds via the getUserId Parse cloud function, which performs no authentication before resolving and returning identifiers tied to any supplied email address or username. Any remote attacker can silently map organizational email addresses or usernames to their internal Parse database identifiers without triggering authentication. This reconnaissance capability enables targeted follow-on attacks, such as credential stuffing, phishing, or chained exploitation of other endpoints that accept objectIds. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Technical ContextAI
OpenSign is an open-source electronic document signing platform built on the Parse Platform (parse-server), a Node.js backend framework that exposes Cloud Functions - server-side JavaScript functions callable over HTTP or the Parse SDK. The vulnerable function, getUserId, is a Parse Cloud Function that accepts an email address or username and returns the corresponding internal Parse objectId without any session token or access-control check. CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) captures this root cause: the function intentionally performs a lookup but unintentionally omits the authentication gate before returning a sensitive identifier. The objectId in Parse uniquely identifies a user record and is often accepted by other API endpoints, making its disclosure a meaningful stepping stone for further enumeration or attack. Affected products per CPE: cpe:2.3:a:opensignlabs:opensign:*:*:*:*:*:*:*:* covering all versions up to and including 2.37.0.
RemediationAI
The primary fix should be to add server-side authentication enforcement to the getUserId Parse Cloud Function so that only authenticated sessions with appropriate permissions can resolve email addresses or usernames to internal objectIds. Administrators should upgrade to a version of OpenSign that includes this fix - however, no specific patched release version is identified in the available data; monitor the upstream GitHub repository at https://github.com/OpenSignLabs/OpenSign for a tagged release addressing this issue (patch availability per vendor is not independently confirmed from the provided references). As an interim compensating control, organizations running internet-facing deployments should restrict access to the Parse Cloud Function endpoint (typically /parse/functions/getUserId) via a reverse proxy or WAF rule, accepting the trade-off that any legitimate client functionality relying on this function will also be blocked. Internal-only deployments should enforce network-level access controls to limit exposure to trusted network segments. Rate limiting on the Parse functions endpoint can reduce bulk enumeration impact without blocking the function entirely.
Information disclosure in OpenSignLabs OpenSign through 2.37.0 exposes complete organisation tenant records to unauthent
Unauthenticated contact record enumeration in OpenSignLabs OpenSign through 2.37.0 exposes all stored personally identif
Unauthenticated remote write to any contact record is possible in OpenSignLabs OpenSign through version 2.37.0 via the u
OpenSign through version 2.37.0 exposes an unauthenticated remote integrity bypass in its document audit-trail mechanism
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today