Unauthenticated Contact Record Manipulation in OpenSign

An insecure direct object reference vulnerability in OpenSignLabs OpenSign through 2.37.0 allows unauthenticated remote attackers to write to any contact record via the updatecontacttour Parse cloud function. The function performs no authentication or authorization before updating the target contact record. An attacker can corrupt or overwrite contact data for any user in the system without credentials.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

OpenSign versions through 2.37.0 contain an insecure direct object reference (IDOR) vulnerability in the updatecontacttour Parse cloud function that allows unauthenticated attackers to read, modify, or corrupt contact records for any user. Because the function performs no authentication or authorization checks before processing update requests, an attacker can systematically alter contact data across the entire user base without credentials. This affects all organizations running vulnerable OpenSign instances, particularly those managing sensitive contact information for business operations, compliance, or customer relationships.

Casky's 283 matched skills leverage Claude's extended reasoning to detect the attack patterns mapped to TA0004 (Privilege Escalation) and TA0006 (Credential Access) by identifying suspicious updatecontacttour function calls that originate from unauthenticated sessions or lack proper authorization tokens. Practitioners would observe findings showing direct object reference patterns—requests targeting contact IDs outside the requester's scope, batch update operations without valid session context, or repeated contact record modifications from anonymous sources. The skill set helps teams correlate these reconnaissance and exploitation signals with typical IDOR attack chains, enabling detection of both single-record probes and widespread data corruption attempts before widespread damage occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-72545.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

cryptography · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-72545

Casky has 283 skills that investigate the attack patterns behind CVE-2026-72545. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn