Description
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target contact record. An attacker can corrupt or overwrite contact data for any user in the system without credentials.
Published: 2026-08-11
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A failure to enforce authentication or authorization in OpenSignLabs OpenSign allows remote attackers to invoke the updatecontacttour cloud function and write to any contact record. The vulnerability, identified as an insecure direct object reference (CWE‑639), enables an attacker to corrupt or overwrite personal data for any user without credentials, undermining data integrity and potentially exposing sensitive information.

Affected Systems

The flaw exists in all releases of OpenSignLabs OpenSign through version 2.37.0. Any deployment of those versions that exposes the updatecontacttour service is affected.

Risk and Exploitability

With a CVSS score of 7.5 the vulnerability is considered high severity. The EPSS score is not available, so the current probability of exploitation cannot be quantified, but the function is remotely accessible and requires no authentication, making exploitation straightforward. The vulnerability is not listed in the CISA KEV catalog, yet its reach to all contact records warrants urgent mitigation.

Generated by OpenCVE AI on August 11, 2026 at 17:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade OpenSign to the latest released version that includes a fix for the updatecontacttour function
  • Add authentication and proper access controls to the updatecontacttour cloud function so that only authorized users can invoke it
  • Enforce authorization checks within the function to ensure that the caller can modify only their own contact record or records they are explicitly permitted to change

Generated by OpenCVE AI on August 11, 2026 at 17:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://github.com/OpenSignLabs/OpenSign cve-icon cve-icon
History

Thu, 13 Aug 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Opensignlabs
Opensignlabs opensign
Vendors & Products Opensignlabs
Opensignlabs opensign

Tue, 11 Aug 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Description An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target contact record. An attacker can corrupt or overwrite contact data for any user in the system without credentials.
Title OpenSignLabs OpenSign - Insecure Direct Object Reference
Weaknesses CWE-639
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}

Subscriptions

Opensignlabs Opensign
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-11T15:07:50.383Z

Reserved: 2026-08-10T10:32:49.081Z

Link: CVE-2026-72545

cve-icon Vulnrichment

Updated: 2026-08-11T15:07:42.768Z

cve-icon NVD

Status : Received

Published: 2026-08-11T12:17:39.987

Modified: 2026-08-11T16:17:34.817

Link: CVE-2026-72545

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-13T09:54:48Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key