High

OpenSignLabs OpenSign - Insecure Direct Object Reference

Type: advisorySources: OSV

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks before returning the requested contact object. An attacker can enumerate and read all contact records including personally identifiable information without credentials.

Products: Not specified
Affected versions: Not specified
Fixed versions: Not specified
CVEs: CVE-2026-72543
Confirmed fixed CVEs: Not specified
Updated in this feed: 4 Nov 2026, 15:57 UTC · Revision 1

Source evidence

OpenSignLabs OpenSign - Insecure Direct Object Reference

core-osv · Original source

Published 11 Aug 2026, 11:08 UTC

osv:CVE-2026-72543

Complete source record

{
  "id": "3cf78b9f7ff49ab108e4b121ad4f577c4c62aa2bf0775d892c2a1e28619fff98",
  "url": "https://osv.dev/vulnerability/CVE-2026-72543",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "OpenSignLabs OpenSign - Insecure Direct Object Reference",
    "summary": "An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks before returning the requested contact object. An attacker can enumerate and read all contact records including personally identifiable information without credentials.",
    "evidence": "osv:CVE-2026-72543",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-72543",
      "aliases": [
        "CVE-2026-72543"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/opensignlabs/opensign",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "a56b87a7020de74b0f7dda29d7ec3de382a456bb"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2.37.0"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2.37.0"
                      }
                    ],
                    "source": "DESCRIPTION"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.38.0",
            "v2.37.0",
            "v2.36.0",
            "v2.35.0",
            "v2.34.0",
            "v2.33.0",
            "v2.32.0",
            "v2.31.0",
            "v2.30.0",
            "v2.29.2",
            "v2.29.1",
            "v2.29.0",
            "v2.28.0",
            "v2.27.2",
            "v2.26.0",
            "v2.25.0",
            "v2.24.1",
            "v2.23.0",
            "v2.22.0",
            "v2.21.1",
            "v2.21.0",
            "v2.20.1",
            "v2.20.0",
            "v2.19.2",
            "v2.19.1",
            "v2.19.0",
            "v2.18.0",
            "v2.17.0",
            "v2.16.0",
            "v2.15.0",
            "v2.13.0",
            "v2.7.0",
            "v2.12.0",
            "v2.6.0",
            "v2.5.0",
            "v2.4.1",
            "v2.4.0",
            "v2.3.3",
            "v2.3.2",
            "v2.3.1",
            "v2.3.0",
            "v2.2.0",
            "v2.1.2",
            "v2.1.1",
            "v2.1.0",
            "v2.0.0",
            "v1.8.1",
            "v1.8.0",
            "v1.7.3",
            "v1.7.2",
            "v1.7.1",
            "v1.7.0",
            "v1.6.2",
            "v1.6.1",
            "v1.6.0",
            "v1.5.8",
            "v1.5.1",
            "v1.5.0",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0-beta",
            "1.3.2-beta",
            "v1.3.1-beta",
            "v1.3.0-beta",
            "v1.2.2-beta",
            "v1.2.1-beta",
            "v1.2.0-beta",
            "v1.1.1-beta",
            "v1.1.0-beta",
            "v1.0.7-beta",
            "v1.0.6-beta",
            "v1.0.5-beta",
            "v1.0.3"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-72543.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:36.989484882Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72543.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-72543",
        "https://github.com/OpenSignLabs/OpenSign"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-639"
        ],
        "cna_assigner": "TuranSec",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72543.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-72543",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 504398,
  "published_at": "2026-08-11T11:08:45.898+00:00"
}