CVE-2026-71247

Received Received - Intake

Assistant Signature Forgery in Documenso Signing UI

Publication date: 2026-08-05

Last updated on: 2026-08-10

Assigner: TuranSec

Description

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-05

Last Modified

2026-08-10

Generated

2026-08-25

AI Q&A

2026-08-05

EPSS Evaluated

2026-08-24

NVD

CVE-2026-71247

EUVD

EUVD-2026-53320

Affected Vendors & Products

Vendor	Product	Version / Range
documenso	documenso	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Documenso allows a user with the ASSISTANT role to forge signatures for other recipients in the same document. The flaw exists in the V1 signing path where no check ensures the assistant owns the signature field they are completing. This enables sequential-signing documents to have fake signatures added without detection.

Detection Guidance

This vulnerability involves improper handling of signature fields in Documenso's V1 signing path. Detection requires checking for unauthorized signature completions by ASSISTANT role users. Review logs for sign-field-with-token.ts API calls and verify signature field ownership in sequential-signing documents. No specific commands are provided in the context.

Impact Analysis

If you use Documenso for document signing, an attacker with assistant privileges could forge signatures on your documents. This could lead to unauthorized approvals, fraudulent agreements, or compliance violations if the forged signatures are relied upon for legal or regulatory purposes.

Compliance Impact

This vulnerability could undermine compliance with GDPR, HIPAA, and other regulations requiring non-repudiation and tamper-proof records. Forged signatures may invalidate audit trails, breach data integrity requirements, and expose organizations to legal or regulatory penalties due to unreliable documentation.

Mitigation Strategies

Update Documenso to the latest version that includes the V2 signing path or applies the missing guard in the V1 path. Review document envelopes for unauthorized signature completions by ASSISTANT role recipients.

Hi! I’m here to help you understand CVE-2026-71247. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70