The vulnerability in OpenSignLabs OpenSign (through 2.37.0) involves the gettenant Parse cloud function, which accepts a contactId parameter and returns the full tenant record. Due to lack of authentication and authorization checks, unauthenticated remote attackers can exploit this to retrieve sensitive tenant configuration data for any organization. This constitutes an exposure of sensitive information (CWE-200). The CVSS 3.1 score is 7.5 (High), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact without integrity or availability impact. No patch or official remediation information is provided, and no known exploits are reported in the wild.

An attacker can remotely and without authentication access sensitive tenant configuration data of any organization using the vulnerable gettenant function. This exposure of sensitive information could lead to privacy violations or facilitate further attacks based on disclosed tenant data. There is no impact on integrity or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the gettenant function or implement authentication and authorization controls to prevent unauthorized data retrieval.