The vulnerability in Documenso's sign-field-with-token.ts arises because the handler permits recipients with the ASSISTANT role to fetch and complete fields belonging to any recipient with a later or equal signing order in the same envelope, without verifying that the field type is a signature or that the acting recipient owns the field. This lack of access control allows an assistant to forge signature fields of other signers in sequential signing workflows. The project's newer V2 signing path explicitly prevents assistants from completing signature fields, but this safeguard is missing in the V1 path, making it vulnerable to signature forgery attacks.

An attacker with the ASSISTANT role can forge signature fields of other recipients in the same envelope, compromising the integrity of the document signing process. This can lead to unauthorized completion of signature fields, potentially invalidating the trustworthiness of signed documents. The vulnerability does not affect confidentiality or availability but impacts the integrity of signatures.

No official patch or fix is currently documented for this vulnerability. Since the newer V2 signing path (sign-envelope-field.ts) includes protections against this issue, migrating to or enforcing the use of the V2 signing path is recommended. Until an official fix is released, restrict ASSISTANT role permissions or avoid using the vulnerable V1 signing path to prevent exploitation.