CVE-2026-72543
HighCVSS 7.5Summary
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks before returning the requested contact object. An attacker can enumerate and read all contact records including personally identifiable information without credentials.
Risk Assessment
The risk includes confidentiality breach of personal data, which can lead to GDPR and other regulatory violations. It may also expose the organization to financial penalties and loss of trust.
Recommendation
It is recommended to immediately apply patches or add authentication and authorization in the getcontact function. Also conduct an audit of access to personal data.
Original NVD description (English source)
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any contact record via the getcontact Parse cloud function. The function executes with useMasterKey and performs no authentication or authorization checks before returning the requested contact object. An attacker can enumerate and read all contact records including personally identifiable information without credentials.