A vulnerability was detected in Documenso up to 2

Documenso is an open-source, self-hosted alternative to DocuSign for e-signing contracts. CVE-2026-13543 is an improper authentication flaw (CWE-287) affecting all releases through 2.11.0. The vendor description is intentionally thin — the CVSS vector tells the real story: network-reachable (AV:N), no privileges (PR:N), no user interaction (UI:N), but high attack complexity (AC:H) and only low impact on confidentiality, integrity, and availability. That points to an edge-case auth path — likely a token-handling, session-binding, or signer-link verification weakness — that leaks or partially manipulates a single signing session rather than handing over the whole tenant.

The vendor's MEDIUM/5.6 rating is fair to slightly generous. AC:H plus three Low impact ratings is the textbook profile of a contestable, race-condition-flavored auth bug — not a credential bypass. We're nudging the score down to 4.5 because Documenso's enterprise install base is small, prod deployments are almost always behind SSO/VPN, and there is no public PoC or exploitation chatter as of disclosure day.

Why this verdict

• High attack complexity (AC:H) — exploitation requires winning a race or predicting state, not a one-shot curl, so opportunistic mass exploitation is unlikely.
• Low impact across CIA — vendor explicitly scores C:L/I:L/A:L, capping realistic damage at one signing session, not the tenant or host.
• Narrow exposure population — Documenso enterprise installs are overwhelmingly behind SSO or private network; internet-facing footprint is in the low hundreds globally.
• Role multiplier: Documenso is a document-signing application — not in the high-value-role catalog (no IdP, hypervisor, CA, PAM, backup, or kernel agent characteristics). Worst plausible role outcome: leakage of signed legal documents from one tenant — serious for the affected business, but not fleet-scale.
• No KEV, no PoC, no chatter — disclosure-day baseline with zero exploitation evidence keeps the urgency dial low.

Why not higher?

HIGH would require either fleet-scale blast radius or active exploitation. Neither exists: the bug is bounded to a single signing session (S:U + Low impacts) and there is no PoC, KEV listing, or telemetry of in-the-wild use. Documenso does not occupy a high-value role that forces a HIGH floor.

Why not lower?

LOW would understate the regulatory and contractual sensitivity of e-signed documents. A confidentiality leak from a signing flow can expose contract terms, signer identity, or legal positioning — material harm even at C:L. The network-reachable, no-auth-required precondition also means the bug is probeable from the public internet wherever the instance is exposed, which keeps it above pure backlog hygiene.

1. Front Documenso with an authenticating reverse proxy — Put Cloudflare Access, Tailscale, Pomerium, or oauth2-proxy in front of /api/* and /signin so unauthenticated network reach is impossible. This neutralizes the AV:N + PR:N preconditions entirely. MEDIUM verdict carries no mitigation SLA — fold this into the 365-day remediation window or do it now if you happen to have an exposed instance.
2. Rate-limit and alert on signing endpoints — The AC:H exploit profile means an attacker must hammer the endpoint to win the race. A 10 req/sec per-IP cap on /api/signing/* and an alert at 100 req/min raises exploitation cost to near-zero return. Deploy alongside the patch.
3. Audit recent signing-flow telemetry — Pull the last 90 days of Documenso audit logs and correlate signing events against expected signer source IPs. Anomalies here are your only retroactive detection if the bug was exploited pre-disclosure.
4. Subscribe to Documenso's GitHub Security Advisories — The vendor publishes via GHSA; subscribing gives you the fixed-version tag the moment it ships so you can close the remediation loop.

Run on the Documenso host (or any host with curl that can reach the instance) as any user. Invoke with the base URL of your deployment, e.g. ./check_documenso.sh https://sign.corp.example.com. No privileges required beyond network reach.

#!/usr/bin/env bash
# CVE-2026-13543 — Documenso ≤ 2.11.0 improper authentication check
# Usage: ./check_documenso.sh <base_url>
# Exit: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

set -u
BASE="${1:-}"
if [ -z "$BASE" ]; then
  echo "UNKNOWN: usage $0 <base_url>" >&2
  exit 2
fi

# Documenso exposes build metadata at /api/health or surfaces version in the
# footer / og:meta tags. Try the API endpoint first, fall back to HTML scrape.
VER=$(curl -fsSL --max-time 10 "$BASE/api/health" 2>/dev/null \
      | grep -oE '"version"[[:space:]]*:[[:space:]]*"[^"]+"' \
      | head -1 \
      | sed -E 's/.*"([^"]+)"$/\1/')

if [ -z "$VER" ]; then
  VER=$(curl -fsSL --max-time 10 "$BASE/" 2>/dev/null \
        | grep -oE 'documenso[/-]v?[0-9]+\.[0-9]+\.[0-9]+' \
        | head -1 \
        | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
fi

if [ -z "$VER" ]; then
  echo "UNKNOWN: could not determine Documenso version at $BASE"
  exit 2
fi

# semver compare against 2.11.0
IFS=. read -r MA MI PA <<< "$VER"
if [ "$MA" -lt 2 ] || { [ "$MA" -eq 2 ] && [ "$MI" -lt 11 ]; } || { [ "$MA" -eq 2 ] && [ "$MI" -eq 11 ] && [ "$PA" -le 0 ]; }; then
  echo "VULNERABLE: Documenso $VER ≤ 2.11.0 — CVE-2026-13543 applies"
  exit 1
fi

echo "PATCHED: Documenso $VER > 2.11.0"
exit 0

Sources

1. GitHub Advisory Database (unreviewed)
2. Documenso GitHub repository
3. Documenso GitHub Security Advisories
4. CISA Known Exploited Vulnerabilities Catalog
5. MITRE CWE-287: Improper Authentication
6. NVD CVE-2026-13543
7. FIRST EPSS lookup
8. VulDB CVE index