A flaw in Documenso's sign‑field‑with‑token endpoint permits a recipient holding an Assistant role to fetch and complete fields belonging to any later-or-equal-order, not‑yet-signed recipient in the same envelope, without restriction on field type. The handler creates a Signature record for the target field without verifying that the field type is a signature or that the acting recipient owns the target. In a sequential‑signing workflow, an assistant can therefore forge another signer's signature field, producing a legally binding but unauthorized completion of the document. The newer V2 signing path explicitly blocks assistants from completing SIGNATURE fields, and the project's test suite confirms this guard is absent from the V1 path used here.

This vulnerability affects the Documenso application, specifically versions that employ the V1 signing path sign‑field‑with‑token.ts. Any deployment that does not use the newer V2 signing logic sign‑envelope‑field.ts, which blocks assistants from signing signature fields, is potentially impacted.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score is 0.00174% and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have an Assistant role within the same envelope, typically via the web interface that accepts token‑based field submissions. Forging a signature undermines the integrity of contractual documents and can expose the organization to legal fraud and compliance violations.