CVE-2026-71247
Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents
CVSS Score
6.5
EPSS Score
0.0%
EPSS Percentile
0th
Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here.
| CWE | CWE-863 |
| Vendor | documenso |
| Product | documenso |
| Published | Aug 5, 2026 |
| Last Updated | Aug 10, 2026 |
Stay Ahead of the Next One
Get instant alerts for documenso documenso
Be the first to know when new medium vulnerabilities affecting documenso documenso are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Affected Versions
documenso / documenso
0
Credits
Bobur Abdugafforov