Description

A broken object-level authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read complete contract records via the getDocument Parse cloud function. The function fetches documents using useMasterKey, bypassing the object ACL, and returns full records including sender and signer PII and a pre-signed document download URL whenever the document's IsEnableOTP flag is unset, which is the default configuration.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T13:20:39.103Z",
  "pubdate": "2026-08-10T13:20:39.103Z",
  "executiveSummary": "A Broken Object-Level Authorization (BOLA) vulnerability exists in OpenSignLabs opensignserver through 2.37.0. The security defect allows an unauthenticated remote attacker to retrieve complete contract records without authorization. The affected system is OpenSignServer up to version 2.37.0, specifically impacting the document retrieval mechanisms.\nThe primary impact of this vulnerability is unauthorized data exposure, granting malicious actors access to sensitive user data, personally identifiable information (PII) of senders and signers, and pre-signed document download URLs. This introduces severe privacy risks, potential data leakage, and compliance violations.\nThe attacker capabilities involve remote, unauthenticated exploitation over the network. The exploitation requirements are minimal due to a default configuration where the IsEnableOTP flag remains unset, exposing records without additional validation layers.\nThe risk implications are high, as unauthorized external entities can harvest sensitive contractual and personal data at scale by interacting directly with exposed backend cloud functions.",
  "technicalDetails": "The root cause of the vulnerability stems from insecure implementation of data access controls within the Parse cloud function responsible for document retrieval, specifically the getDocument function in OpenSignLabs opensignserver through 2.37.0. The vulnerable component fails to properly enforce object-level authorization checks before processing data requests from clients.\nDuring execution, the getDocument Parse cloud function fetches documents using useMasterKey. The utilization of the master key bypasses the underlying database object Access Control Lists (ACLs), disabling standard permission enforcement mechanisms native to the data architecture. Consequently, access restrictions configured on individual contract records are ignored entirely.\nThe vulnerability is heavily influenced by the document state configuration. Specifically, full records including sensitive metadata are returned whenever the document's IsEnableOTP flag is unset. Because this represents the default configuration out-of-the-box, a vast majority of deployments are susceptible to this exposure without manual administrative hardening.\nThe attack flow proceeds as follows: First, an unauthenticated remote attacker identifies the network exposure of the Parse server API endpoints. Second, the attacker formulates a request targeting the getDocument Parse cloud function. Third, the attacker supplies identifiers for target contract records without providing any valid session tokens, authentication credentials, or multi-factor tokens, relying on the default unset state of the IsEnableOTP flag.\nFourth, the vulnerable backend executes the retrieval routine utilizing the useMasterKey parameter, bypassing object ACL enforcement. Fifth, the server compiles and returns the complete contract record payload in the response to the unauthenticated caller. The returned payload contains sensitive data fields, including sender and signer PII alongside a pre-signed document download URL.\nPost-exploitation impact includes the systematic enumeration and harvesting of confidential contracts and Personally Identifiable Information. Armed with the pre-signed document download URLs, the attacker can subsequently download the associated documents directly, entirely circumventing authentication and authorization boundaries."
}