This vulnerability (CWE-306) in OpenSignLabs opensignserver through version 2.37.0 allows unauthenticated remote attackers to exploit the fileupload Parse cloud function to obtain MASTER_KEY-signed file access tokens for arbitrary URLs. Since the function does not perform any session or authentication checks before minting these tokens, attackers can read stored documents that should be protected by access controls. The vulnerability results from missing authentication for a critical function that controls access to sensitive stored contract files.

An attacker without any authentication can read arbitrary stored documents by abusing the fileupload Parse cloud function. This leads to a confidentiality breach of sensitive contract files stored on the server. There is no impact on integrity or availability reported. The vulnerability allows unauthorized data disclosure.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the affected function or server if possible to prevent unauthenticated access.