CVE-2026-72692: opensignserver missing authz forges

CISO Take

This vulnerability in OpenSignLabs' opensignserver e-signature platform lets any unauthenticated attacker who knows or guesses a document ID permanently mark that document as declined and falsely attribute the decline to an arbitrary user, because the declinedoc Parse cloud function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without checking who's calling. For a CISO the real risk is business and legal disruption, not system takeover: contracts, HR paperwork, or vendor agreements can be silently killed and the blame pinned on someone who never touched them, undermining the evidentiary trail organizations rely on for e-signature workflows. The CVSS 7.5 score reflects a network-exploitable, zero-privilege, zero-interaction attack (AV:N/AC:L/PR:N/UI:N), though EPSS sits at just 0.272% (roughly the 80th percentile), the CVE is absent from CISA KEV, there is no public PoC or Nuclei template, and CISA's SSVC decision is TRACK — so opportunistic mass exploitation is unlikely today, though a targeted actor could weaponize it trivially. No patched version has been identified yet, so until OpenSignLabs ships a fix, firewall or restrict access to the declinedoc endpoint, enforce session/authentication checks at the reverse proxy in front of Parse Server, and audit decline events for documents lacking a corresponding legitimate session.

Sources: NVD CISA KEV EPSS ATLAS

What is the risk?

High exploitability, low-severity blast radius: the attack requires no authentication, no user interaction, and only network access (AV:N/AC:L/PR:N/UI:N), making it trivial to script against any exposed instance. However, the CVSS vector shows impact is confined to integrity (I:H) with no confidentiality or availability effect — an attacker cannot read data or take down the service, only corrupt the state and attribution of specific documents. Real-world exploitation pressure is currently low: EPSS is 0.272% (roughly 80th percentile, not top-tier), the CVE isn't in CISA KEV, no public exploit or Nuclei template exists, and CISA scored it SSVC TRACK (monitor, not urgent). Overall this is a high-severity-by-CVSS but low-current-exploitation-pressure finding that should be patched on a normal cycle but escalated immediately if any exploit code surfaces.

How does the attack unfold?

Reconnaissance

Attacker locates a public-facing opensignserver instance and obtains or enumerates a valid in-flight document ID.

AML.T0006

Exploitation

Attacker calls the unauthenticated declinedoc Parse cloud function directly, supplying the document ID and an arbitrary DeclineBy user pointer.

AML.T0049

Impact

The document workflow is irreversibly terminated and the decline is falsely attributed to a legitimate user, corrupting the audit trail and potentially triggering incorrect downstream actions in any automated process relying on that event.

Reconnaissance

Attacker locates a public-facing opensignserver instance and obtains or enumerates a valid in-flight document ID.

AML.T0006

Exploitation

Attacker calls the unauthenticated declinedoc Parse cloud function directly, supplying the document ID and an arbitrary DeclineBy user pointer.

AML.T0049

Impact

The document workflow is irreversibly terminated and the decline is falsely attributed to a legitimate user, corrupting the audit trail and potentially triggering incorrect downstream actions in any automated process relying on that event.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
opensignserver	—	—	No patch

Do you use opensignserver? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 20% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I High

A None

What should I do?

1 step

No patched version is currently listed for opensignserver (fixed release not yet published as of 2026-08-10) — track the OpenSignLabs GitHub repository for a fix and upgrade as soon as one ships. In the interim: place the Parse Server endpoint behind an authenticating reverse proxy or WAF rule that blocks unauthenticated calls to the declinedoc cloud function; if self-hosting, patch the cloud function to validate the caller's session/identity against the document's assigned signer before writing IsDeclined/DeclineBy; restrict network exposure of the Parse API to trusted networks/VPN where feasible; and add detection for declinedoc calls with no valid session token or where DeclineBy does not match the authenticated caller. Audit existing declined documents for anomalous DeclineBy attributions as a compromise check.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable Yes

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent Plugin AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 12 - Record-keeping

NIST AI RMF

GOVERN 6.1 - Third-party and supply chain risks

Frequently Asked Questions

What is CVE-2026-72692?

This vulnerability in OpenSignLabs' opensignserver e-signature platform lets any unauthenticated attacker who knows or guesses a document ID permanently mark that document as declined and falsely attribute the decline to an arbitrary user, because the declinedoc Parse cloud function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without checking who's calling. For a CISO the real risk is business and legal disruption, not system takeover: contracts, HR paperwork, or vendor agreements can be silently killed and the blame pinned on someone who never touched them, undermining the evidentiary trail organizations rely on for e-signature workflows. The CVSS 7.5 score reflects a network-exploitable, zero-privilege, zero-interaction attack (AV:N/AC:L/PR:N/UI:N), though EPSS sits at just 0.272% (roughly the 80th percentile), the CVE is absent from CISA KEV, there is no public PoC or Nuclei template, and CISA's SSVC decision is TRACK — so opportunistic mass exploitation is unlikely today, though a targeted actor could weaponize it trivially. No patched version has been identified yet, so until OpenSignLabs ships a fix, firewall or restrict access to the declinedoc endpoint, enforce session/authentication checks at the reverse proxy in front of Parse Server, and audit decline events for documents lacking a corresponding legitimate session.

Is CVE-2026-72692 actively exploited?

No confirmed active exploitation of CVE-2026-72692 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-72692?

No patched version is currently listed for opensignserver (fixed release not yet published as of 2026-08-10) — track the OpenSignLabs GitHub repository for a fix and upgrade as soon as one ships. In the interim: place the Parse Server endpoint behind an authenticating reverse proxy or WAF rule that blocks unauthenticated calls to the declinedoc cloud function; if self-hosting, patch the cloud function to validate the caller's session/identity against the document's assigned signer before writing IsDeclined/DeclineBy; restrict network exposure of the Parse API to trusted networks/VPN where feasible; and add detection for declinedoc calls with no valid session token or where DeclineBy does not match the authenticated caller. Audit existing declined documents for anomalous DeclineBy attributions as a compromise check.

What systems are affected by CVE-2026-72692?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks.

What is the CVSS score for CVE-2026-72692?

CVE-2026-72692 has a CVSS v3.1 base score of 7.5 (HIGH). The EPSS exploitation probability is 0.27%.

What is the AI security impact?

Affected AI Architectures

agent frameworks

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Article 12

NIST AI RMF: GOVERN 6.1

What are the technical details?

Original Advisory

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.

Exploitation Scenario

An attacker who has learned or guessed a target document's object ID (e.g., leaked in a URL, email, or via ID enumeration) sends an unauthenticated request directly to the opensignserver declinedoc Parse cloud function, supplying that document ID along with a DeclineBy pointer referencing a legitimate employee's user object. The server processes the request without verifying the caller's identity, irreversibly marking the document as declined and recording the decline as if the named employee had rejected it. If OpenSign is embedded in an automated business process — for instance, an AI-driven procurement or onboarding agent that watches for decline events to trigger cancellation logic — the forged decline propagates into that automation, disrupting the deal and creating a falsified audit record that implicates an innocent employee.

Weaknesses (CWE)

CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.