Insecure Direct Object Reference (IDOR) Leading to Signature Forgery in Foxit eSign

published 2026-04-01 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-17767

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 7%
public exploits: 0; none known

Addressed a potential insecure direct object reference (IDOR) vulnerability in the signing invitation acceptance process. Under certain conditions, this issue could have allowed an attacker to access or modify unauthorized resources by manipulating user-supplied object identifiers, potentially leading to forged signatures and compromising the integrity and authenticity of documents undergoing the signing process. The issue was caused by insufficient authorization validation on referenced resources during request processing.

Patch / fix

fixed in 1

foxit esign 2026-03-26

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 7 mo ago (2026-04-01)

Exploit prediction

0.18% chance of exploitation in the next 30 days, higher than 7% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Affected products

Foxit Software Inc. na1.foxitesign.foxit.com

Classification

Weakness

CWE-284 Improper Access Control

References

foxit.com /support/security-bulletins.html
vendor-advisory

Sources

CVE List CVE-2026-4947
NVD CVE-2026-4947

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary