High severity7.5NVD Advisory· Published Aug 11, 2026
CVE-2026-72548
CVE-2026-72548
Description
An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=2.37.0
Patches
Vulnerability mechanics
News mentions
0No linked articles in our index yet.