Documenso's sign-field-with-token.ts component in the live document-signing UI allows a recipient with the ASSISTANT role to fetch and complete fields of any later-or-equal-order recipient in the same envelope without proper restrictions. This includes the ability to upsert signature records for fields not owned by the acting recipient, enabling an assistant to forge another signer's signature in sequential-signing documents. A newer signing path (sign-envelope-field.ts) mitigates this by blocking assistants from completing signature fields, but this protection is absent in the vulnerable V1 path.