CVE-2026-72549

MEDIUM 5.3

OpenSignLabs OpenSign - Information Disclosure

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can use this to enumerate user accounts and target subsequent attacks.

CWE	CWE-200
Vendor	opensignlabs
Product	opensign
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for opensignlabs opensign

Be the first to know when new medium vulnerabilities affecting opensignlabs opensign are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

OpenSignLabs / OpenSign

0 ≤ 2.37.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/OpenSignLabs/OpenSign

Credits

Bobur Abdugafforov (Mahadsec)