CVE-2026-92794 Details
Description
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identity, and valid download tokens without authentication.
A vulnerability in OpenSign versions through 2.41.3 allows unauthorized access to sensitive document information via the 'getDocument' cloud function. When one-time-password verification is disabled, attackers can exploit this flaw by using a document identifier from guest signing links to obtain full document details. This includes personal information of all signers, the sender's identity, and valid download tokens, all without any form of authentication.
Users can manually enable one-time-password verification for documents to prevent this type of information disclosure. However, this vulnerability highlights a need for a more robust authorization check in the 'getDocument' cloud function, such as requiring the caller to provide a contact ID that matches an entry in the document's signer list.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/OpenSignLabs/OpenSign | [email protected] | Source CodeVendor |
| https://github.com/OpenSignLabs/OpenSign/blob/v2.41.0/apps/OpenSignServer/cloud/parsefunction/getDocument.js#L20-L32 | [email protected] | Source CodeVendor |
| https://github.com/OpenSignLabs/OpenSign/issues/2218 | [email protected] | ExploitIssue TrackingTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/opensign-through-2.41.3-information-disclosure-via-getdocument | [email protected] | AdvisoryExploitTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| OpenSign | <= 2.41.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 17, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |