Description

A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud function. The function writes IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer without verifying the caller's identity, enabling workflow termination and evidentiary record falsification against any accessible document.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-10T13:20:39.470Z",
  "pubdate": "2026-08-10T13:20:39.470Z",
  "executiveSummary": "A missing authorization vulnerability exists in OpenSignLabs opensignserver up to version 2.37.0, specifically within the declinedoc Parse cloud function. This security flaw allows unauthenticated remote attackers to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user. The vulnerability presents significant operational and legal risks by enabling malicious workflow termination and the falsification of evidentiary records against any accessible document within the system. Attackers require network access to the target instance but no prior authentication or administrative privileges to successfully execute the exploit. Remediation requires updating the affected software once a patched version is made available or implementing strict access controls at the Parse cloud function layer.",
  "technicalDetails": "The vulnerability resides in the backend logic of the opensignserver application, specifically inside the Parse cloud function designated as declinedoc. The root cause of the security issue is a complete lack of proper authorization checks and caller identity verification before processing state-changing operations on document records. When invoked, the vulnerable function processes incoming requests to update document states without validating whether the requesting entity possesses the necessary permissions or session context to modify the specific document.\nDuring execution, the declinedoc Parse cloud function writes critical state parameters directly to the database, including IsDeclined, DeclineReason, and a caller-supplied DeclineBy pointer. Because the function blindly accepts the user-supplied pointer without verifying the caller's identity against the document's access control list or workflow participants, an unauthenticated remote attacker can inject arbitrary values into the DeclineBy field.\nThe attack flow proceeds as follows: First, an unauthenticated remote attacker identifies an in-flight document target within the opensignserver instance. Second, the attacker crafts a malicious payload targeting the declinedoc Parse cloud function over the network. Third, within the payload, the attacker sets the IsDeclined flag to true, provides a crafted DeclineReason, and specifies an arbitrary user identifier in the DeclineBy pointer parameter. Fourth, upon receiving the request, the vulnerable function processes the transaction without authentication or authorization validation, committing the state change to the database.\nThe post-exploitation impact includes the permanent termination of critical document workflows and the severe falsification of audit and evidentiary records. Because the decline attribution can be spoofed to point to any arbitrary user in the system, non-repudiation guarantees are entirely compromised, leading to potential legal, compliance, and data integrity failures across all affected deployments of opensignserver through version 2.37.0."
}