The vulnerability is a missing authentication in the OpenSignLabs opensignserver, allowing an attacker who is not logged in to read any stored contract files. The fileupload Parse cloud function issues MASTER_KEY‑signed file access tokens for any caller‑supplied URL without checking the session, effectively bypassing the only access control on stored documents. An attacker can use the tokens to retrieve arbitrary stored files over HTTP, leading to confidential data leakage.

All instances of OpenSignLabs opensignserver up to and including version 2.37.0 are affected. Users running this software retain the same access control mechanism using signed tokens but lack necessary authentication checks. No later releases were mentioned as fixed in the provided data.

The CVSS score of 7.5 indicates a high severity vulnerability. No EPSS score is available, and the vulnerability is not listed in CISA’s KEV catalog, suggesting unknown exploitation activity. The likely attack vector is a remote HTTP call to the fileupload Parse endpoint; no local privilege escalation or code execution is described, but an unauthenticated attacker can read any contract file exposed by the server. Given the lack of an authentication barrier, the risk to confidentiality is significant for systems that expose this endpoint to untrusted networks.