A flaw in Documenso's sign‑field‑with‑token endpoint permits a recipient holding an Assistant role to create and submit signature entries for other recipients. The handler creates a Signature record for the target field without verifying that the field type is a signature or that the acting recipient owns the target. In a sequential‑signing workflow, an assistant can therefore forge another signer's signature field, producing a legally binding but unauthorized completion of the document.

This vulnerability affects the Documenso application, specifically versions that employ the V1 signing path sign‑field‑with‑token.ts. Any deployment that does not use the newer V2 signing logic sign‑envelope‑field.ts, which blocks assistants from signing signature fields, is potentially impacted.

The CVSS score of 6.5 indicates a moderate severity, while the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to have an Assistant role within the same envelope, typically via the web interface that accepts token‑based field submissions. Forging a signature undermines the integrity of contractual documents and can expose the organization to legal fraud and compliance violations.