CVE-2026-72544
HighCVSS 7.5Summary
An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without authentication, allowing fabrication of arbitrary audit log entries. An attacker can tamper with the legal audit trail of any signed document, undermining non-repudiation.
Risk Assessment
The risk includes integrity breach of audit logs, which can lead to undermining the validity of signatures and legal documents. It may also expose the organization to legal consequences.
Recommendation
It is recommended to immediately apply patches or add authentication and authorization in the triggerevent function. Also monitor audit logs for unauthorized entries.
Original NVD description (English source)
An integrity verification vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to forge document audit-trail entries via the triggerevent Parse cloud function. The function accepts viewer identity and IP address as caller-supplied parameters without authentication, allowing fabrication of arbitrary audit log entries. An attacker can tamper with the legal audit trail of any signed document, undermining non-repudiation.