CVE-2026-4947

Insecure Direct Object Reference (IDOR) Leading to Signature Forgery in Foxit eSign

State: Published
Severity: 7.1 High
Published: Apr 1, 2026
Updated: Apr 2, 2026
Reserved: Mar 27, 2026

Description

Addressed a potential insecure direct object reference (IDOR) vulnerability in the signing invitation acceptance process. Under certain conditions, this issue could have allowed an attacker to access or modify unauthorized resources by manipulating user-supplied object identifiers, potentially leading to forged signatures and compromising the integrity and authenticity of documents undergoing the signing process. The issue was caused by insufficient authorization validation on referenced resources during request processing.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N	Foxit

Weaknesses

CWE-284 Improper Access Control

Affected Products

Product	Versions
na1.foxitesign.foxit.comFoxit Software Inc.	before 2026-03-26Affected

References

https://www.foxit.com/support/security-bulletins.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.