CVE-2026-72545
HighCVSS 7.5Summary
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target contact record. An attacker can corrupt or overwrite contact data for any user in the system without credentials.
Risk Assessment
The risk includes integrity breach of contact data, which can lead to manipulation of user data and potential social engineering attacks. It may also undermine trust in the system.
Recommendation
It is recommended to immediately apply patches or add authentication and authorization in the updatecontacttour function. Also conduct an audit of contact data.
Original NVD description (English source)
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target contact record. An attacker can corrupt or overwrite contact data for any user in the system without credentials.