CVE-2026-72548
HighCVSS 7.5Summary
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.
Risk Assessment
The risk includes disclosure of sensitive organizational configuration data, which can lead to confidentiality breaches and enable further attacks. It may also undermine customer trust.
Recommendation
It is recommended to immediately apply patches or restrict access to the gettenant function by requiring authentication and authorization. Also conduct an audit of data access.
Original NVD description (English source)
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.