CVE-2026-72549
MediumCVSS 5.3Summary
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can enumerate user accounts and target subsequent attacks.
Risk Assessment
Account enumeration facilitates targeted attacks such as phishing or account takeover attempts.
Recommendation
Update OpenSign to a version that requires authentication in the getUserId function.
Original NVD description (English source)
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can use this to enumerate user accounts and target subsequent attacks.