CVE-2026-72691

CVE-2026-72691 is an authentication bypass in a Parse Cloud function that generates signed URLs for document access. The vulnerability stems from a design flaw where authentication is treated as conditional rather than mandatory: the code checks 'if docId exists, skip auth,' meaning any request with a provided docId bypasses the authentication check entirely. Worse, the function accepts arbitrary strings as docIds without server-side validation, so an attacker can trigger the auth bypass simply by providing any non-empty value. The practical impact is severe. The function returns bearer tokens that operate outside the normal authentication session—once generated, these URLs bypass rate limiting, session tracking, and user-level audit logging. This transforms an access control flaw into a persistent, stateless credential that can be replayed from any IP indefinitely. For a document signing platform, the implications extend beyond unauthorized access: the arbitrary-string acceptance enables systematic enumeration of the document namespace, revealing which documents, contracts, or sensitive instruments exist in the system. Even without reading content, knowing that a specific deal-related document exists is strategically valuable intelligence. The root cause is architectural. Parse Cloud Functions exist precisely as escape hatches from Parse's Class-Level Permissions (CLP) model—they run arbitrary logic outside the intended security boundary. This function likely predates CLP or was written before the team adopted CLP, and the 'isAuthenticated' check that should gate this function was either removed during development or never properly applied. The fact that arbitrary strings bypass auth entirely suggests the function never calls Parse.Query.get() on the actual document, which would have implicitly enforced CLP. Instead, it accepts any input and proceeds directly to token generation. To assess your exposure: audit other Parse Cloud Functions in your codebase for the same conditional-auth pattern—if one function exhibits this anti-pattern, others likely do. Check whether the signed URL generation logs or meters requests by user identity; if not, you have both an auth bypass and no audit trail. Assume the document namespace is partially compromised and review access logs for anomalous patterns around the signed URL endpoint. The fix requires two changes: enforce authentication unconditionally before any logic executes, and validate the docId against actual Parse objects before generating tokens—if the document doesn't exist, return the same error response as an unauthenticated request to eliminate enumeration differences.

Reviewed through automated stages and approved by a human before publication.