starred/documenso

Fork 0

mirror of https://github.com/documenso/documenso.git synced 2026-04-24 21:36:01 +03:00

[GH-ISSUE #844] Security Issue in signing a document as any recipient. #261

New issue

Closed

opened 2026-02-26 18:46:10 +03:00 by kerem · 6 comments

kerem commented

2026-02-26 18:46:10 +03:00

Owner

Originally created by @Aman0802 on GitHub (Jan 19, 2024).
Original GitHub issue: https://github.com/documenso/documenso/issues/844

Originally assigned to: @Aman0802 on GitHub.

Issue Description

For signing any document as a recipient, we need to have the token for the recipient. Once we have the token, we can sign as any recipient. Once I get the token for another recipient I would be able to sign as that user. You might think how will one get the token, but when the documents are being listed on the /documents page, I can easily fetch the token of any other recipient from the network tab and go to /sign/[token] page, paste their token and sign as that specific recipient.

Steps to Reproduce

Create a document with multiple recipients to sign. On the /documents page, open the network tab and see the recipients in the api call. Copy the token, and redirect to /sign/[token]. You would be able to sign as that recipient.

Expected Behavior

One should not be able to see the fields and even sign as that recipient, when they come on /sign/[token]. A more secure way needs to be thought of.

Current Behavior

I can sign as any other recipient and complete the document.

Screenshots (optional)

No response

Operating System [e.g., Windows 10]

No response

Browser [e.g., Chrome, Firefox]

No response

Version [e.g., 2.0.1]

No response

Please check the boxes that apply to this issue report.

I have searched the existing issues to make sure this is not a duplicate.
I have provided steps to reproduce the issue.
I have included relevant environment information.
I have included any relevant screenshots.
I understand that this is a voluntary contribution and that there is no guarantee of resolution.
I want to work on creating a PR for this issue if approved

Originally created by @Aman0802 on GitHub (Jan 19, 2024). Original GitHub issue: https://github.com/documenso/documenso/issues/844 Originally assigned to: @Aman0802 on GitHub. ### Issue Description For signing any document as a recipient, we need to have the token for the recipient. Once we have the token, we can sign as any recipient. Once I get the token for another recipient I would be able to sign as that user. You might think how will one get the token, but when the documents are being listed on the /documents page, I can easily fetch the token of any other recipient from the network tab and go to /sign/[token] page, paste their token and sign as that specific recipient. ### Steps to Reproduce Create a document with multiple recipients to sign. On the /documents page, open the network tab and see the recipients in the api call. Copy the token, and redirect to /sign/[token]. You would be able to sign as that recipient. ### Expected Behavior One should not be able to see the fields and even sign as that recipient, when they come on /sign/[token]. A more secure way needs to be thought of. ### Current Behavior I can sign as any other recipient and complete the document. ### Screenshots (optional) _No response_ ### Operating System [e.g., Windows 10] _No response_ ### Browser [e.g., Chrome, Firefox] _No response_ ### Version [e.g., 2.0.1] _No response_ ### Please check the boxes that apply to this issue report. - [X] I have searched the existing issues to make sure this is not a duplicate. - [X] I have provided steps to reproduce the issue. - [X] I have included relevant environment information. - [X] I have included any relevant screenshots. - [X] I understand that this is a voluntary contribution and that there is no guarantee of resolution. - [X] I want to work on creating a PR for this issue if approved

kerem

2026-02-26 18:46:10 +03:00

closed this issue
added the
type: bug

priority: high

apps: web

💰 Rewarded
labels

kerem commented

2026-02-26 18:46:11 +03:00

Author

Owner

@github-actions[bot] commented on GitHub (Jan 19, 2024):

Thank you for opening your first issue and for being a part of the open signing revolution!

One of our team members will review it and get back to you as soon as it possible 💚

Meanwhile, please feel free to hop into our community in Discord

@github-actions[bot] commented on GitHub (Jan 19, 2024): Thank you for opening your first issue and for being a part of the open signing revolution! <br /> One of our team members will review it and get back to you as soon as it possible 💚 <br /> Meanwhile, please feel free to hop into our community in [Discord](https://documen.so/discord)

kerem commented

2026-02-26 18:46:11 +03:00

Author

Owner

@Aman0802 commented on GitHub (Jan 19, 2024):

I would like to take this up.

@Aman0802 commented on GitHub (Jan 19, 2024): I would like to take this up.

kerem commented

2026-02-26 18:46:11 +03:00

Author

Owner

@Mythie commented on GitHub (Jan 21, 2024):

/tip 100

Thanks for catching this! Resolved the issue for recipients being able to see tokens in their inbox, owners on the other hand are allowed to copy signing links to send it via other channels when email doesn't work 😄

@Mythie commented on GitHub (Jan 21, 2024): /tip 100 Thanks for catching this! Resolved the issue for recipients being able to see tokens in their inbox, owners on the other hand are allowed to copy signing links to send it via other channels when email doesn't work 😄

kerem commented

2026-02-26 18:46:11 +03:00

Author

Owner

@algora-pbc[bot] commented on GitHub (Jan 21, 2024):

@Aman0802: You just got a $100 tip! 👉 Complete your Algora onboarding to collect your payment.

@algora-pbc[bot] commented on GitHub (Jan 21, 2024): @Aman0802: You just got a **$100** tip! 👉 [Complete your Algora onboarding](https://console.algora.io) to collect your payment.

kerem commented

2026-02-26 18:46:11 +03:00

Author

Owner

@algora-pbc[bot] commented on GitHub (Jan 21, 2024):

🎉🎈 @Aman0802 has been awarded $100! 🎈🎊

@algora-pbc[bot] commented on GitHub (Jan 21, 2024): 🎉🎈 @Aman0802 has been awarded **$100**! 🎈🎊 - [Share on socials](https://console.algora.io/awards/clrn653z80004jw0frwvpfrhs) - [Give feedback](https://console.algora.io/claims/clrn653z80004jw0frwvpfrhs)

kerem commented

2026-02-26 18:46:11 +03:00

Author

Owner

@Aman0802 commented on GitHub (Jan 21, 2024):

Thanks! It amazing working on this!

@Aman0802 commented on GitHub (Jan 21, 2024): Thanks! It amazing working on this!

kerem referenced this issue

2026-02-26 19:30:40 +03:00

[PR #261] [MERGED] Feat/funding #832

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

starred/documenso#261

No description provided.

Rows
Columns