CVE-2026-72692
Received Received - Intake

Unauthenticated Document Decline in OpenSignLabs opensignserver

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Description
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-72692
EUVD
EUVD-2026-55535

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
opensignlabs opensignserver 2.37.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authorization issue in OpenSignLabs opensignserver version 2.37.0 or earlier. An unauthenticated remote attacker can use the declinedoc Parse cloud function to decline any document in flight and falsify the reason and user responsible for the decline. The function does not verify the caller's identity before writing decline-related data.

Detection Guidance

This vulnerability can be detected by checking for unauthorized document declines in OpenSignLabs opensignserver logs. Look for declinedoc function calls with IsDeclined, DeclineReason, and DeclineBy fields set without proper authentication. Monitor for sudden workflow terminations or forged decline attributions.

Impact Analysis

An attacker could terminate document workflows without permission and manipulate records to blame another user. This could disrupt business processes, create false audit trails, and damage trust in document integrity. The impact is limited to documents accessible through the vulnerable system.

Compliance Impact

This vulnerability could undermine compliance by allowing unauthorized changes to document status and attribution. GDPR requires data integrity and accountability, while HIPAA demands audit controls; falsified records may violate these requirements. Organizations using this software should address it to maintain regulatory compliance.

Mitigation Strategies

Immediately update OpenSignLabs opensignserver to the latest version beyond 2.37.0. Restrict network access to the declinedoc Parse cloud function. Review logs for signs of exploitation and revoke any unauthorized document declines. Implement strict authentication for all document modification functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72692. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart