An insecure direct object reference flaw in OpenSignLabs OpenSign versions up to 2.37.0 lets an attacker, without any authentication, invoke the getcontact Parse cloud function. The function runs with useMasterKey and performs no checks, returning the requested contact record. This is a CWE-639 insecure direct object reference vulnerability that enables enumeration and read of all contacts, exposing personally identifiable information via a simple HTTP request.

The vulnerability affects installations of OpenSignLabs OpenSign version 2.37.0 and earlier. Any deployment that has not been updated to a newer patch is at risk. This includes self‑hosted instances as well as public deployments that expose the Parse endpoint.

The flaw carries a CVSS score of 7.5, indicating a high risk to confidentiality. EPSS is not available, so the exploitation likelihood cannot be quantified, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the vulnerability remotely with no credentials by sending a request to the unprotected getcontact function, enumerating all contact records and harvesting PII. Because no authentication is required, the risk is high for any exposed OpenSign deployment.