A broken object-level authorization flaw in OpenSignLabs OpenSignserver enables an unauthenticated remote attacker to retrieve complete contract records, including sender and signer PII, and obtain pre‑signed download URLs. The vulnerability stems from the getDocument Parse cloud function using the master key and bypassing the document’s access control list. When the IsEnableOTP flag is unset— which is the default configuration— the function returns full records irrespective of ACL settings, exposing sensitive information to anyone who can trigger the function.

OpenSignLabs OpenSignserver versions up to and including 2.37.0 are affected. Versions newer than 2.37.0 are not reported to be vulnerable.

The CVSS score of 7.5 indicates a high‑severity risk. Although the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the attack vector is remote and unauthenticated. An attacker can simply invoke the vulnerable function to access private records. The default configuration setting (IsEnableOTP unset) lowers the barrier to exploitation; enabling OTP would mitigate the risk.