Security Advisory

CVE-2026-72548

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-11 11:09:58

Last updated 2026-08-11 15:10:49

Assigner TuranSec

CVSS score not scored

State PUBLISHED

Description

An information disclosure vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to retrieve any organisation tenant record via the gettenant Parse cloud function. The function accepts a contactId parameter and returns the full tenant record without authentication or authorization checks. An attacker can enumerate and disclose tenant configuration data for any organisation in the system.

← Browse all CVEs View on cve.org ↗