Vulnerability · Published Aug 11, 2026 · Assigned by TuranSec

CVE-2026-72545OpenSignLabs OpenSign - Insecure Direct Object Reference

High 7.5

In plain English

A high-severity authorization bypass via user-controlled key in OpenSign from OpenSignLabs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 54.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target contact record. An attacker can corrupt or overwrite contact data for any user in the system without credentials.

Affected products (as reported)

Vendor	Product	Versions
OpenSignLabs	OpenSign	0 – through 2.37.0

Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References

Project Repository