The vulnerability is an insecure direct object reference (CWE-639) in OpenSignLabs OpenSign through version 2.37.0. The getcontact Parse cloud function executes with useMasterKey privileges but does not perform any authentication or authorization checks before returning requested contact objects. As a result, unauthenticated remote attackers can enumerate and read all contact records, exposing sensitive personal data. No patch or official remediation level is currently documented. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact.

Attackers can remotely and without authentication access all contact records stored by OpenSign, including personally identifiable information. This leads to a significant confidentiality breach. There is no impact on integrity or availability reported. The exposure of sensitive user data can result in privacy violations and potential misuse of personal information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the getcontact function or disable it if possible. Implement additional authentication and authorization controls on cloud functions that handle sensitive data to prevent unauthorized access.