CVE-2026-72545highCWE-639

CVE-2026-72545: high-severity vulnerability in OpenSignLabs OpenSign

OpenSignLabs OpenSign - Insecure Direct Object Reference

Published

Follow this CVE+ Monitor OpenSign

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.5%
An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target contact record. An attacker can corrupt or overwrite contact data for any user in the system without credentials.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Affected products
OpenSignLabs · OpenSign
Related CVEs — OpenSignLabs OpenSign

In the same product, most dangerous first.

CVE-2026-72548HIGHOpenSignLabs OpenSign - Information DisclosureEPSS 0.6%CVE-2026-72543HIGHOpenSignLabs OpenSign - Insecure Direct Object ReferenceEPSS 0.6%CVE-2026-92794HIGHOpenSign through 2.41.3 Information Disclosure via getDocumentEPSS 0.6%CVE-2026-72549MEDIUMOpenSignLabs OpenSign - Information DisclosureEPSS 0.5%CVE-2026-72544HIGHOpenSignLabs OpenSign - Insufficient Verification of Data AuthenticityEPSS 0.3%