Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
8 vulnerabilities by documenso
CVE-2026-85697 (GCVE-0-2026-85697)
Vulnerability from nvd – Published: 2026-09-04 14:32 – Updated: 2026-09-04 17:42
VLAI
EPSS
VEX
Title
Documenso 2.17.0 PDF Route Ignores Document Visibility
Summary
Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data identifiers.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 17:42 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/documenso/documenso/issues/3112 | issue-tracking |
| https://github.com/documenso/documenso | product |
| https://github.com/documenso/documenso/blob/v2.17… | technical-description |
| https://www.vulncheck.com/advisories/documenso-2.… | third-party-advisory |
Impacted products
Date Public
2026-07-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85697",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:42:36.114391Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:42:57.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/documenso/documenso/issues/3112"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "documenso",
"vendor": "documenso",
"versions": [
{
"lessThanOrEqual": "2.17.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data identifiers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:39.491Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #3112",
"tags": [
"issue-tracking"
],
"url": "https://github.com/documenso/documenso/issues/3112"
},
{
"tags": [
"product"
],
"url": "https://github.com/documenso/documenso"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/documenso/documenso/blob/v2.17.0/apps/remix/server/api/files/files.helpers.ts"
},
{
"name": "VulnCheck Advisory: Documenso 2.17.0 PDF Route Ignores Document Visibility",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/documenso-2.17.0-pdf-route-ignores-document-visibility"
}
],
"title": "Documenso 2.17.0 PDF Route Ignores Document Visibility",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85697",
"datePublished": "2026-09-04T14:32:39.491Z",
"dateReserved": "2026-09-04T13:51:52.593Z",
"dateUpdated": "2026-09-04T17:42:57.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82472 (GCVE-0-2026-82472)
Vulnerability from nvd – Published: 2026-08-29 16:35 – Updated: 2026-08-31 18:52
VLAI
EPSS
VEX
Title
Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf
Summary
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:33 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/documenso/documenso/commit/4f3… | patch |
| https://github.com/documenso/documenso/blob/v2.12… | technical-description |
| https://github.com/documenso/documenso | product |
| https://www.vulncheck.com/advisories/documenso-be… | third-party-advisory |
Impacted products
Date Public
2026-06-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82472",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:33:59.893494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:52:46.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/documenso/root",
"product": "documenso",
"vendor": "documenso",
"versions": [
{
"lessThan": "2.13.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T16:35:32.453Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/documenso/documenso/commit/4f346d3c2d5264f221e4d787e162f16051e44114"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/documenso/documenso/blob/v2.12.0/apps/remix/server/api/files/files.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/documenso/documenso"
},
{
"name": "VulnCheck Advisory: Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/documenso-before-2.13.0-unauthenticated-file-upload-via-api-files-upload-pdf"
}
],
"title": "Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82472",
"datePublished": "2026-08-29T16:35:32.453Z",
"dateReserved": "2026-08-29T14:11:13.578Z",
"dateUpdated": "2026-08-31T18:52:46.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71247 (GCVE-0-2026-71247)
Vulnerability from nvd – Published: 2026-08-05 10:56 – Updated: 2026-08-10 11:46
VLAI
EPSS
VEX
Title
Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents
Summary
Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 12:31 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/documenso/documenso | third-party-advisory |
Date Public
2026-08-05 10:56
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71247",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T12:31:13.509667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:16.403Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "documenso",
"programFiles": [
"packages/lib/server-only/field/sign-field-with-token.ts"
],
"vendor": "documenso",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bobur Abdugafforov"
}
],
"datePublic": "2026-08-05T10:56:59.954Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDocumenso\u0027s sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project\u0027s own test suite comments confirm this guard is absent from the V1 path used here.\u003c/p\u003e"
}
],
"value": "Documenso\u0027s sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project\u0027s own test suite comments confirm this guard is absent from the V1 path used here."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:46:00.855Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/documenso/documenso"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Documenso - Assistant Recipient Can Forge Another Signer\u0027s Signature in Sequential-Signing Documents"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71247",
"datePublished": "2026-08-05T10:56:59.954Z",
"dateReserved": "2026-08-05T10:53:53.176Z",
"dateUpdated": "2026-08-10T11:46:00.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-52271 (GCVE-0-2024-52271)
Vulnerability from nvd – Published: 2024-12-05 13:56 – Updated: 2024-12-05 16:53 X_Known Exploited Vulnerability X_Open Source
VLAI
EPSS
VEX
Title
PDF Document Spoofing in Documenso
Summary
User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.
This issue affects Documenso: through 1.8.0, >1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-05 14:14 UTC
CWE
- CWE-451 - User Interface (UI) Misrepresentation of Critical Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.vulsec.org/advisories | vdb-entry |
| https://github.com/documenso/documenso | product |
| https://www.documenso.com/ | product |
| https://github.com/documenso/documenso/issues/1512 | issue-tracking |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Documenso | Documenso |
Affected:
0 , ≤ 1.8.0
(git)
Affected: >1.8.0 (git) |
|
| Documenso | Documenso SaaS (Hosted) |
Affected:
0 , ≤ 2024-12-05
(date)
Affected: 2024-12-05 (date) |
|
| documenso | documenso |
Affected:
0 , ≤ 1.8.0
(git)
Affected: 1.8.0* cpe:2.3:a:documenso:documenso:*:*:*:*:*:*:*:* |
|
| documenso | documenso |
Affected:
0 , ≤ 2024-12-05
(custom)
Affected: 2024-12-05 cpe:2.3:a:documenso:documenso:*:*:*:*:saas:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:documenso:documenso:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "documenso",
"vendor": "documenso",
"versions": [
{
"lessThanOrEqual": "1.8.0",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"status": "affected",
"version": "1.8.0*"
}
]
},
{
"cpes": [
"cpe:2.3:a:documenso:documenso:*:*:*:*:saas:*:*:*"
],
"defaultStatus": "unknown",
"product": "documenso",
"vendor": "documenso",
"versions": [
{
"lessThanOrEqual": "2024-12-05",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2024-12-05"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52271",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-05T14:14:26.736144Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-05T16:45:56.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Documenso",
"repo": "https://github.com/documenso/documenso",
"vendor": "Documenso",
"versions": [
{
"lessThanOrEqual": "1.8.0",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"status": "affected",
"version": "\u003e1.8.0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Documenso SaaS (Hosted)",
"vendor": "Documenso",
"versions": [
{
"lessThanOrEqual": "2024-12-05",
"status": "affected",
"version": "0",
"versionType": "date"
},
{
"status": "affected",
"version": "2024-12-05",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Erez Kalman"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDisplayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -\u0026gt; Examine the print preview): Will render the vulnerability only, not all layers are flattened.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Documenso: through 1.8.0, \u0026gt;1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05.\u003c/p\u003e"
}
],
"value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -\u003e Examine the print preview): Will render the vulnerability only, not all layers are flattened.\n\n\nThis issue affects Documenso: through 1.8.0, \u003e1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Known, potentially in use (e.g., spear phishing)"
}
],
"value": "Known, potentially in use (e.g., spear phishing)"
}
],
"impacts": [
{
"capecId": "CAPEC-148",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-148 Content Spoofing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-05T16:53:23.959Z",
"orgId": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
"shortName": "VULSec"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://www.vulsec.org/advisories"
},
{
"tags": [
"product"
],
"url": "https://github.com/documenso/documenso"
},
{
"tags": [
"product"
],
"url": "https://www.documenso.com/"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/documenso/documenso/issues/1512"
}
],
"source": {
"discovery": "USER"
},
"tags": [
"x_known-exploited-vulnerability",
"x_open-source"
],
"title": "PDF Document Spoofing in Documenso",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003eIf other party initiated e-signing - Download the PDF file for a security professionals/educated persons inspection\u003c/li\u003e\u003cli\u003eIf possible -\u0026nbsp;Download the PDF file and perform full flattening (of the entire document, not just form fields)\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
}
],
"value": "* If other party initiated e-signing - Download the PDF file for a security professionals/educated persons inspection\n * If possible -\u00a0Download the PDF file and perform full flattening (of the entire document, not just form fields)"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
"assignerShortName": "VULSec",
"cveId": "CVE-2024-52271",
"datePublished": "2024-12-05T13:56:08.185Z",
"dateReserved": "2024-11-06T08:35:09.852Z",
"dateUpdated": "2024-12-05T16:53:23.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-85697 (GCVE-0-2026-85697)
Vulnerability from cvelistv5 – Published: 2026-09-04 14:32 – Updated: 2026-09-04 17:42
VLAI
EPSS
VEX
Title
Documenso 2.17.0 PDF Route Ignores Document Visibility
Summary
Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data identifiers.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-04 17:42 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/documenso/documenso/issues/3112 | issue-tracking |
| https://github.com/documenso/documenso | product |
| https://github.com/documenso/documenso/blob/v2.17… | technical-description |
| https://www.vulncheck.com/advisories/documenso-2.… | third-party-advisory |
Impacted products
Date Public
2026-07-19 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-85697",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-04T17:42:36.114391Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T17:42:57.629Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/documenso/documenso/issues/3112"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "documenso",
"vendor": "documenso",
"versions": [
{
"lessThanOrEqual": "2.17.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-07-19T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Documenso 2.17.0 contains an access control vulnerability in the PDF-serving endpoint that fails to validate document visibility settings. Attackers with low privileges can read restricted documents within their team or cross-tenant by leveraging missing ownership validation on document data identifiers."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-04T14:32:39.491Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #3112",
"tags": [
"issue-tracking"
],
"url": "https://github.com/documenso/documenso/issues/3112"
},
{
"tags": [
"product"
],
"url": "https://github.com/documenso/documenso"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/documenso/documenso/blob/v2.17.0/apps/remix/server/api/files/files.helpers.ts"
},
{
"name": "VulnCheck Advisory: Documenso 2.17.0 PDF Route Ignores Document Visibility",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/documenso-2.17.0-pdf-route-ignores-document-visibility"
}
],
"title": "Documenso 2.17.0 PDF Route Ignores Document Visibility",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-85697",
"datePublished": "2026-09-04T14:32:39.491Z",
"dateReserved": "2026-09-04T13:51:52.593Z",
"dateUpdated": "2026-09-04T17:42:57.629Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82472 (GCVE-0-2026-82472)
Vulnerability from cvelistv5 – Published: 2026-08-29 16:35 – Updated: 2026-08-31 18:52
VLAI
EPSS
VEX
Title
Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf
Summary
Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-31 16:33 UTC
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/documenso/documenso/commit/4f3… | patch |
| https://github.com/documenso/documenso/blob/v2.12… | technical-description |
| https://github.com/documenso/documenso | product |
| https://www.vulncheck.com/advisories/documenso-be… | third-party-advisory |
Impacted products
Date Public
2026-06-18 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82472",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-31T16:33:59.893494Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-31T18:52:46.322Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/documenso/root",
"product": "documenso",
"vendor": "documenso",
"versions": [
{
"lessThan": "2.13.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "George Chen"
}
],
"datePublic": "2026-06-18T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Documenso before 2.13.0 accepts PDF file uploads on the /api/files/upload-pdf endpoint without requiring authentication, session tokens, or API credentials. Unauthenticated attackers can upload arbitrary PDF files indefinitely to exhaust storage resources or fill the database with unlinked document records."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 8.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-29T16:35:32.453Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "Patch Commit",
"tags": [
"patch"
],
"url": "https://github.com/documenso/documenso/commit/4f346d3c2d5264f221e4d787e162f16051e44114"
},
{
"tags": [
"technical-description"
],
"url": "https://github.com/documenso/documenso/blob/v2.12.0/apps/remix/server/api/files/files.ts"
},
{
"tags": [
"product"
],
"url": "https://github.com/documenso/documenso"
},
{
"name": "VulnCheck Advisory: Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/documenso-before-2.13.0-unauthenticated-file-upload-via-api-files-upload-pdf"
}
],
"title": "Documenso before 2.13.0 Unauthenticated File Upload via /api/files/upload-pdf",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82472",
"datePublished": "2026-08-29T16:35:32.453Z",
"dateReserved": "2026-08-29T14:11:13.578Z",
"dateUpdated": "2026-08-31T18:52:46.322Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-71247 (GCVE-0-2026-71247)
Vulnerability from cvelistv5 – Published: 2026-08-05 10:56 – Updated: 2026-08-10 11:46
VLAI
EPSS
VEX
Title
Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents
Summary
Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-05 12:31 UTC
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://github.com/documenso/documenso | third-party-advisory |
Date Public
2026-08-05 10:56
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-71247",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-05T12:31:13.509667Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:32:16.403Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "documenso",
"programFiles": [
"packages/lib/server-only/field/sign-field-with-token.ts"
],
"vendor": "documenso",
"versions": [
{
"status": "affected",
"version": "0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Bobur Abdugafforov"
}
],
"datePublic": "2026-08-05T10:56:59.954Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eDocumenso\u0027s sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project\u0027s own test suite comments confirm this guard is absent from the V1 path used here.\u003c/p\u003e"
}
],
"value": "Documenso\u0027s sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project\u0027s own test suite comments confirm this guard is absent from the V1 path used here."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-10T11:46:00.855Z",
"orgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"shortName": "TuranSec"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://github.com/documenso/documenso"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Documenso - Assistant Recipient Can Forge Another Signer\u0027s Signature in Sequential-Signing Documents"
}
},
"cveMetadata": {
"assignerOrgId": "309f9ea4-e3e9-4c6c-b79d-e8eb01244f2c",
"assignerShortName": "TuranSec",
"cveId": "CVE-2026-71247",
"datePublished": "2026-08-05T10:56:59.954Z",
"dateReserved": "2026-08-05T10:53:53.176Z",
"dateUpdated": "2026-08-10T11:46:00.855Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-52271 (GCVE-0-2024-52271)
Vulnerability from cvelistv5 – Published: 2024-12-05 13:56 – Updated: 2024-12-05 16:53 X_Known Exploited Vulnerability X_Open Source
VLAI
EPSS
VEX
Title
PDF Document Spoofing in Documenso
Summary
User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -> Examine the print preview): Will render the vulnerability only, not all layers are flattened.
This issue affects Documenso: through 1.8.0, >1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-05 14:14 UTC
CWE
- CWE-451 - User Interface (UI) Misrepresentation of Critical Information
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://www.vulsec.org/advisories | vdb-entry |
| https://github.com/documenso/documenso | product |
| https://www.documenso.com/ | product |
| https://github.com/documenso/documenso/issues/1512 | issue-tracking |
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Documenso | Documenso |
Affected:
0 , ≤ 1.8.0
(git)
Affected: >1.8.0 (git) |
|
| Documenso | Documenso SaaS (Hosted) |
Affected:
0 , ≤ 2024-12-05
(date)
Affected: 2024-12-05 (date) |
|
| documenso | documenso |
Affected:
0 , ≤ 1.8.0
(git)
Affected: 1.8.0* cpe:2.3:a:documenso:documenso:*:*:*:*:*:*:*:* |
|
| documenso | documenso |
Affected:
0 , ≤ 2024-12-05
(custom)
Affected: 2024-12-05 cpe:2.3:a:documenso:documenso:*:*:*:*:saas:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:documenso:documenso:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "documenso",
"vendor": "documenso",
"versions": [
{
"lessThanOrEqual": "1.8.0",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"status": "affected",
"version": "1.8.0*"
}
]
},
{
"cpes": [
"cpe:2.3:a:documenso:documenso:*:*:*:*:saas:*:*:*"
],
"defaultStatus": "unknown",
"product": "documenso",
"vendor": "documenso",
"versions": [
{
"lessThanOrEqual": "2024-12-05",
"status": "affected",
"version": "0",
"versionType": "custom"
},
{
"status": "affected",
"version": "2024-12-05"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-52271",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-05T14:14:26.736144Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-05T16:45:56.693Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Documenso",
"repo": "https://github.com/documenso/documenso",
"vendor": "Documenso",
"versions": [
{
"lessThanOrEqual": "1.8.0",
"status": "affected",
"version": "0",
"versionType": "git"
},
{
"status": "affected",
"version": "\u003e1.8.0",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Documenso SaaS (Hosted)",
"vendor": "Documenso",
"versions": [
{
"lessThanOrEqual": "2024-12-05",
"status": "affected",
"version": "0",
"versionType": "date"
},
{
"status": "affected",
"version": "2024-12-05",
"versionType": "date"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Erez Kalman"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDisplayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -\u0026gt; Examine the print preview): Will render the vulnerability only, not all layers are flattened.\u003c/span\u003e\u003cbr\u003e\u003c/p\u003e\u003cp\u003eThis issue affects Documenso: through 1.8.0, \u0026gt;1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05.\u003c/p\u003e"
}
],
"value": "User Interface (UI) Misrepresentation of Critical Information vulnerability in Documenso allows Content Spoofing.Displayed version does not show the layer flattened version, once download, If printed (e.g. via Google Chrome -\u003e Examine the print preview): Will render the vulnerability only, not all layers are flattened.\n\n\nThis issue affects Documenso: through 1.8.0, \u003e1.8.0 and Documenso SaaS (Hosted) as of 2024-12-05."
}
],
"exploits": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Known, potentially in use (e.g., spear phishing)"
}
],
"value": "Known, potentially in use (e.g., spear phishing)"
}
],
"impacts": [
{
"capecId": "CAPEC-148",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-148 Content Spoofing"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "RED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "HIGH",
"userInteraction": "PASSIVE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/U:Red",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-05T16:53:23.959Z",
"orgId": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
"shortName": "VULSec"
},
"references": [
{
"tags": [
"vdb-entry"
],
"url": "https://www.vulsec.org/advisories"
},
{
"tags": [
"product"
],
"url": "https://github.com/documenso/documenso"
},
{
"tags": [
"product"
],
"url": "https://www.documenso.com/"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/documenso/documenso/issues/1512"
}
],
"source": {
"discovery": "USER"
},
"tags": [
"x_known-exploited-vulnerability",
"x_open-source"
],
"title": "PDF Document Spoofing in Documenso",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cul\u003e\u003cli\u003eIf other party initiated e-signing - Download the PDF file for a security professionals/educated persons inspection\u003c/li\u003e\u003cli\u003eIf possible -\u0026nbsp;Download the PDF file and perform full flattening (of the entire document, not just form fields)\u003c/li\u003e\u003c/ul\u003e\u003cbr\u003e"
}
],
"value": "* If other party initiated e-signing - Download the PDF file for a security professionals/educated persons inspection\n * If possible -\u00a0Download the PDF file and perform full flattening (of the entire document, not just form fields)"
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "2fdefc65-d750-4b8d-96ee-6e2c0c42dbfe",
"assignerShortName": "VULSec",
"cveId": "CVE-2024-52271",
"datePublished": "2024-12-05T13:56:08.185Z",
"dateReserved": "2024-11-06T08:35:09.852Z",
"dateUpdated": "2024-12-05T16:53:23.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}