Information Disclosure Vulnerability in OpenSignLabs OpenSign
CVE-2026-72549

5.3MEDIUM

Key Information:

Vendor

Opensignlabs

Status
Opensign
Vendor
CVE Published:
11 August 2026

What is CVE-2026-72549?

An unauthorized information disclosure vulnerability exists in OpenSignLabs OpenSign versions up to 2.37.0. This flaw allows remote attackers to exploit the getUserId Parse cloud function without any authentication, enabling them to link any email address or username to its associated internal user objectId. This can lead to account enumeration and may facilitate further targeted attacks by malicious actors.

Affected Version(s)

OpenSign 0 <= 2.37.0

References

https://github.com/OpenSignLabs/OpenSign

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bobur Abdugafforov (Mahadsec)
.