CVE-2026-72692

OpenSignLabs opensignserver up to version 2.37.0 contains a missing authorization flaw in the declinedoc Parse cloud function. An unauthenticated remote attacker can irreversibly decline any in‑flight document and forge the decline attribution to an arbitrary user by writing IsDeclined, DeclineRe...