Vulnerability Description
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers' information, sender identity, and valid download tokens without authentication.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/OpenSignLabs/OpenSign
- https://github.com/OpenSignLabs/OpenSign/blob/v2.41.0/apps/OpenSignServer/cloud/
- https://github.com/OpenSignLabs/OpenSign/issues/2218
- https://www.vulncheck.com/advisories/opensign-through-2.41.3-information-disclos
FAQ
What is CVE-2026-92794?
CVE-2026-92794 is a vulnerability with a CVSS score of 7.5 (HIGH). OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signi...
How severe is CVE-2026-92794?
CVE-2026-92794 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92794?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.