CVE-2026-72692

Deferred Deferred - Pending Action

Unauthenticated Document Decline in OpenSignLabs opensignserver

Publication date: 2026-08-10

Last updated on: 2026-08-26

Assigner: TuranSec

Description

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-10

Last Modified

2026-08-26

Generated

2026-08-30

AI Q&A

2026-08-10

EPSS Evaluated

2026-08-29

NVD

CVE-2026-72692

EUVD

EUVD-2026-55535

Affected Vendors & Products

Vendor	Product	Version / Range
opensignlabs	opensignserver	2.37.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability is a missing authorization issue in OpenSignLabs opensignserver version 2.37.0 or earlier. An unauthenticated remote attacker can use the declinedoc Parse cloud function to decline any document in flight and falsify the reason and user responsible for the decline. The function does not verify the caller's identity before writing decline-related data.

Detection Guidance

This vulnerability can be detected by checking for unauthorized document declines in OpenSignLabs opensignserver logs. Look for declinedoc function calls with IsDeclined, DeclineReason, and DeclineBy fields set without proper authentication. Monitor for sudden workflow terminations or forged decline attributions.

Impact Analysis

An attacker could terminate document workflows without permission and manipulate records to blame another user. This could disrupt business processes, create false audit trails, and damage trust in document integrity. The impact is limited to documents accessible through the vulnerable system.

Compliance Impact

This vulnerability could undermine compliance by allowing unauthorized changes to document status and attribution. GDPR requires data integrity and accountability, while HIPAA demands audit controls; falsified records may violate these requirements. Organizations using this software should address it to maintain regulatory compliance.

Mitigation Strategies

Immediately update OpenSignLabs opensignserver to the latest version beyond 2.37.0. Restrict network access to the declinedoc Parse cloud function. Review logs for signs of exploitation and revoke any unauthorized document declines. Implement strict authentication for all document modification functions.

Hi! I’m here to help you understand CVE-2026-72692. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70