CVE-2026-72545 OpenSignLabs CVE debrief

Who should care

Organizations using OpenSign through 2.37.0, security teams, and administrators responsible for contact record management should be aware of this vulnerability. They should prioritize immediate inventory checks, verify vendor remediation status, and implement compensating controls if necessary. Additionally, they should review relevant monitoring, detection, and logs for exposed assets that need extra review. Asset inventory and vulnerability management teams should also be informed to ensure proper tracking and remediation of affected systems.

Technical summary

The vulnerability is an insecure direct object reference in OpenSignLabs OpenSign through 2.37.0. The updatecontacttour Parse cloud function allows unauthenticated remote attackers to write to any contact record without authentication or authorization, potentially corrupting or overwriting contact data for any user in the system. This could lead to unauthorized data modifications and potential data integrity issues. Organizations using OpenSign through 2.37.0 should prioritize immediate inventory checks and verify vendor remediation status.

Defensive priority

Organizations using OpenSign through 2.37.0 should prioritize immediate inventory checks and verify vendor remediation status.

Recommended defensive actions

• Inventory checks for OpenSign through 2.37.0
• Verify vendor remediation status
• Implement compensating controls
• Review relevant monitoring, detection, and logs for exposed assets
• Check for asset inventory and vulnerability management tracking
• Plan vendor-supported updates or mitigations through normal change control
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE description indicates an insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0, allowing unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. Evidence is limited to CVE and NVD records. The vulnerability has a CVSS score of 7.5 and is classified as HIGH severity. There is no information on known ransomware campaign use or vendor project/product details. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.