Integrity Verification Vulnerability in OpenSign by OpenSignLabs
CVE-2026-72544

7.5HIGH

Key Information:

Vendor

Opensignlabs

Status
Opensign
Vendor
CVE Published:
11 August 2026

What is CVE-2026-72544?

The integrity verification vulnerability present in OpenSign by OpenSignLabs (up to version 2.37.0) allows unauthorized remote attackers to manipulate document audit-trail entries. This defect exists due to the triggerevent Parse cloud function accepting parameters such as viewer identity and IP address without proper authentication checks. As a result, attackers can create fabricated audit log entries, compromising the integrity of signed documents and threatening non-repudiation principles.

Affected Version(s)

OpenSign 0 <= 2.37.0

References

https://github.com/OpenSignLabs/OpenSign

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobur Abdugafforov (Mahadsec)
.