CVE-2026-71247
Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here.
- Score
- CVSS 3.1 6.5 Medium
- Status
- Deferred - 309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c
- Published
- 2026-08-05
- Last modified
- 2026-08-10
- Weaknesses
- CWE-863
Affected products
References
- https://github.com/documenso/documenso
