The vulnerability resides in the getsignedurl Parse cloud function within OpenSignLabs opensignserver. The function bypasses authentication when the docId parameter is present, even if the document does not exist. An unauthenticated attacker can exploit this by supplying any arbitrary string as docId to mint a MASTER_KEY-signed file access token. The resulting token grants direct access to the requested file, allowing the attacker to view, download, or potentially modify arbitrary stored files, thereby compromising confidentiality and possibly integrity.

All releases of OpenSignLabs opensignserver up to and including version 2.37.0 are affected. The vulnerability applies to the default deployment scenario where the getsignedurl endpoint is publicly reachable. No other vendors or product versions are listed as impacted in the CNA data.

The CVSS score of 7.5 indicates a high severity flaw, while the EPSS score is not reported and the asset is not currently listed in CISA KEV. The attack vector is remote, requiring no prior authentication; the attacker simply crafts a request to the getsignedurl endpoint with any docId. Successful exploitation yields unauthorized download capabilities for any file stored by the application, posing a significant risk to confidentiality.