PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-72549 OpenSignLabs CVE debrief

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-11T12:17:40.483Z and has not been modified since then. This information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to map any email address or username to its internal user objectId via the getUserId Parse cloud function. The function performs no authentication before resolving and returning the internal identifier. An attacker can use this to enumerate user accounts and target subsequent attacks. Security teams and administrators responsible for OpenSignLabs OpenSign deployments should be aware of this vulnerability and take steps to mitigate potential risks. This includes reviewing current versions, assessing exposure, and implementing recommended defensive actions.

Vendor
OpenSignLabs
Product
OpenSign
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-11
Original CVE updated
2026-09-03
Advisory published
2026-08-11
Advisory updated
2026-09-03

Who should care

Security teams and administrators responsible for OpenSignLabs OpenSign deployments should be aware of this vulnerability and take steps to mitigate potential risks. This includes reviewing current versions, assessing exposure, and implementing recommended defensive actions.

Technical summary

The OpenSignLabs OpenSign product through version 2.37.0 contains an information disclosure vulnerability. The getUserId Parse cloud function does not perform authentication before resolving and returning internal user objectIds based on provided email addresses or usernames. This allows unauthenticated remote attackers to map email addresses or usernames to their corresponding internal user objectIds, potentially enabling enumeration of user accounts for targeted attacks.

Defensive priority

Medium-priority defensive review recommended due to potential for user enumeration.

Recommended defensive actions

  • Review and update OpenSignLabs OpenSign to version 2.37.1 or later if available.
  • Implement additional authentication and access controls for the getUserId Parse cloud function.
  • Monitor for and restrict unauthorized access attempts to the affected function.
  • Perform inventory checks for OpenSignLabs OpenSign deployments and assess potential exposure.
  • Consider compensating controls such as web application firewalls or intrusion detection systems.

Evidence notes

Evidence from official CVE and NVD sources indicates an information disclosure vulnerability exists in OpenSignLabs OpenSign through 2.37.0. The getUserId Parse cloud function allows unauthenticated remote attackers to map email addresses or usernames to internal user objectIds. However, detailed technical analysis and additional source validation are needed to fully understand attack vectors and potential mitigations.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-72549 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-72549

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-72549 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-72549

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://github.com/OpenSignLabs/OpenSign

    309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.