Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any later-or-equal-order, not-yet-signed recipient in the same envelope, with no restriction on field type. A newer V2 signing path (sign-envelope-field.ts) explicitly blocks assistants from completing SIGNATURE fields, and the project's own test suite comments confirm this guard is absent from the V1 path used here.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-71247 Signature Forgery in Documenso V1 Sign-Field-With-Token via Unrestricted Assistant Role Access https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-71247
Post summary
The post announces a newly discovered signature forging vulnerability in Documenso V1 linked to unrestricted assistant role access, providing technical specifics but no patch, PoC, or active exploitation evidence.
🚨*CVE* CVE-2026-71247 Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any l… https://www.cve.org/CVERecord?id=CVE-2026-71247 ----- Traducción: CVE-2026-71247 Doc… http://infoflow.cloud`
Post summary
The text is a brief disclosure of CVE‑2026‑71247, highlighting a role‑bypass in Documenso’s document‑signing UI that permits unauthorized field manipulation.
CVE-2026-71247 Documenso's sign-field-with-token.ts, used by the live document-signing UI, allows a recipient with the ASSISTANT role to fetch and complete fields belonging to any l… https://www.cve.org/CVERecord?id=CVE-2026-71247
Post summary
A new CVE-2026-71247 pertains to Documenso’s sign-field-with-token.ts, allowing an ASSISTANT role user to fetch and fill fields in any document. The post discloses the vulnerability details but provides no PoC, exploit code, or patch information.