CVE-2026-72548

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.

CVSS 3.1

7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS

0.6% chance of exploitation in the next 30 days; higher than 49% of CVEs (scores of 2026-10-25)

CWE

CWE-200

Published

2026-08-11

Modified

2026-10-24

Record from

the NVD, synced 2026-10-24

References

• https://github.com/OpenSignLabs/OpenSign

Check your stackJSON