CVE-2026-71247
Received Received - Intake

Assistant Signature Forgery in Documenso Signing UI

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. The handler upserts a Signature record tied to the target field's recipientId with no check that field.type is SIGNATURE and the acting recipient owns it. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here. In a sequential-signing document, an assistant recipient can therefore forge another signer's signature field.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-71247
EUVD
EUVD-2026-53320

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
documenso documenso *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Documenso allows a user with the ASSISTANT role to forge signatures for other recipients in the same document. The flaw exists in the V1 signing path where no check ensures the assistant owns the signature field they are completing. This enables sequential-signing documents to have fake signatures added without detection.

Impact Analysis

If you use Documenso for document signing, an attacker with assistant privileges could forge signatures on your documents. This could lead to unauthorized approvals, fraudulent agreements, or compliance violations if the forged signatures are relied upon for legal or regulatory purposes.

Compliance Impact

This vulnerability could undermine compliance with GDPR, HIPAA, and other regulations requiring non-repudiation and tamper-proof records. Forged signatures may invalidate audit trails, breach data integrity requirements, and expose organizations to legal or regulatory penalties due to unreliable documentation.

Mitigation Strategies

Update Documenso to the latest version that includes the V2 signing path or applies the missing guard in the V1 path. Review document envelopes for unauthorized signature completions by ASSISTANT role recipients.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-71247. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart