HIGH 8.7 NVD
CVE-2026-92794
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can suppl
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identity, and valid download tokens without authentication.
References
- https://github.com/OpenSignLabs/OpenSign
- https://github.com/OpenSignLabs/OpenSign/blob/v2.41.0/apps/OpenSignServer/cloud/parsefunct
- https://github.com/OpenSignLabs/OpenSign/issues/2218
- https://www.vulncheck.com/advisories/opensign-through-2.41.3-information-disclosure-via-ge
This high severity vulnerability with a CVSS score of 8.7 was published on 2026-09-16 via NVD.
vulnfeed aggregates 14597 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.