CVE-2026-92794

OpenSign through 2.41.3 contains a missing-authorization flaw (CWE-862) in its getDocument cloud function, which fails to validate the caller's identity when one-time-password verification is disabled. An unauthenticated attacker who obtains a document identifier, for example from a shared guest signing link, can invoke the function and retrieve complete document details including all signers' information, the sender's identity, and valid download tokens. Because the tokens are valid for download, the attacker can likely retrieve the document contents themselves, though there is no integrity or availability impact. Any OpenSign deployment, self-hosted or cloud, that uses guest signing links with one-time-password verification disabled is affected. No public proof-of-concept or in-the-wild exploitation is currently known, and the flaw is not listed in CISA KEV.

What to do: Upgrade OpenSign to a release newer than 2.41.3 as soon as a patched version is published, and until then enable one-time-password verification for guest signing so the getDocument function enforces caller identity. Restrict direct access to the underlying cloud-function API, treat guest signing links and document identifiers as sensitive, and rotate or revoke download tokens for confidential documents if exposure is suspected.