What’s Vulnerable › Vulnerabilities

CVE-2026-71247: Documenso - Assistant Recipient Can Forge Another Signer's Signature in Sequential-Signing Documents

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-05 · updated 2026-08-26
• Weakness: CWE-863

Description

Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here.

Affected products

• documenso: 0

References

• https://github.com/documenso/documenso

Get alerted when CVE-2026-71247 or the next vulnerability affects your stack