CVE-2026-72548

The critical failure in CVE-2026-72548 isn't the missing authentication on the gettenant Parse cloud function—it's the fundamental misclassification of trust boundaries that allowed this function to exist without access controls in the first place. Parse cloud functions are HTTP-accessible endpoints, yet OpenSignLabs deployed gettenant under the implicit assumption that the Parse layer itself constitutes an authorization boundary. This is architecturally equivalent to placing sensitive database operations behind a URL without authentication because it 'feels internal.' The CVSS 7.5 score correctly captures trivial exploitation, but it obscures the true scope: this is a multi-tenant system where the contactId parameter is likely enumerable, transforming a single-tenant disclosure into systemic enumeration of every tenant in the installation. What makes this analytically distinct from a standard IDOR is the zero-authentication requirement. Most broken object-level authorization vulnerabilities assume valid session credentials. Here, the attack surface is entirely unauthenticated—anyone with network access can potentially enumerate all tenants. Tenant configuration data in a signing platform typically contains API credentials, webhook endpoints, integration tokens, administrative contacts, and audit configuration. This isn't mere organization name disclosure—it's reconnaissance data enabling targeted supply chain attacks against the signing infrastructure itself. Three questions demand immediate investigation. First, what is the contactId generation scheme? Sequential integers or predictable identifiers convert this from information disclosure into mass enumeration of the entire tenant base. Second, do other Parse cloud functions in this deployment share this missing-auth pattern, suggesting systemic insecure defaults rather than isolated oversight? Third, what specific data does tenant configuration contain—API keys, integration secrets, or credentials that would elevate this from disclosure to credential compromise? The remediation extends beyond patching gettenant. Assume complete enumeration capability exists until proven otherwise. Audit every downstream system that consumes tenant configuration data. The trust assumption that generated this vulnerability—'Parse functions are internal by default'—will persist in institutional knowledge unless explicitly addressed in coding standards and code review processes.

Reviewed through automated stages and approved by a human before publication.