CVE-2026-72689 is a broken object-level authorization vulnerability (CWE-639) in OpenSignLabs opensignserver through version 2.37.0. The getDocument Parse cloud function fetches documents using useMasterKey, which bypasses object access control lists (ACLs). When the IsEnableOTP flag on a document is unset (default), the function returns full contract records including sensitive sender and signer PII and a pre-signed document download URL. This allows unauthenticated remote attackers to access sensitive contract data without authorization.

An unauthenticated remote attacker can read complete contract records, including sensitive personally identifiable information of senders and signers, and obtain pre-signed document download URLs. This exposure compromises confidentiality of contract data. There is no indication of impact on integrity or availability. The vulnerability has a CVSS 3.1 base score of 7.5 (high severity), reflecting network attack vector, no privileges required, no user interaction, and high confidentiality impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a patch is available, restrict access to the getDocument function or configure documents with the IsEnableOTP flag enabled to prevent unauthorized data disclosure.