CVE-2026-72543

OpenSignLabs OpenSign (up to version 2.37.0) is affected by an Insecure Direct Object Reference (IDOR) through the getcontact Parse cloud function. The function runs with the useMasterKey and performs no authentication or authorization checks, allowing unauthenticated remote attackers to enumerat...

CVE-2026-72543 OpenSignLabs OpenSign - Insecure Direct Object Reference

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks...