This CVE exposes a BOLA vulnerability in OpenSign where Parse Server's useMasterKey bypasses the ACL system entirely, leaving the OTP flag as the sole authorization gate. If IsEnableOTP is unset (the default), an unauthenticated attacker can retrieve any document by knowing its ID — no authentication required.
The root cause is architectural, not incidental. OpenSign's cloud function uses useMasterKey to read documents, which tells Parse Server 'ignore ACLs, this is a backend operation.' Once useMasterKey is invoked, the entire ACL layer is dead for that code path. The function has no access to the caller's identity to validate against object-level permissions even if the developers wanted to implement that check.
What you should do now: First, verify whether your OpenSign deployment has IsEnableOTP enabled — if it doesn't, you're exposed. Second, audit any Parse Server cloud functions that use useMasterKey and return data based on object IDs passed by callers; these all have the same structural vulnerability regardless of whether OTP is enabled. Third, consider whether OTP as mandatory is an acceptable interim control — it closes this specific path but doesn't fix the underlying architectural weakness: functions that return data without validating caller context against object ownership.
The deeper concern is blast radius. Parse applications using this pattern tend to return rich, interconnected records including PII and pre-signed URLs. When function-level authorization fails, the exposure isn't a single field — it's the entire record type with all associations. That means exploitation here isn't just confidentiality breach; it's an active exfiltration pathway for signer data and signed documents.