CVE-2026-4947
IDOR Vulnerability in Signing Invitation Allows Forged Signatures
Publication date: 2026-04-01
Last updated on: 2026-04-27
Assigner: Foxit
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| foxit | esign | to 2026-03-26 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-284 | The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, users should update their Foxit PDF Reader and Foxit PDF Editor applications to the latest versions.
Updates can be obtained through the application's built-in update feature or by downloading the latest versions from the Foxit website.
Can you explain this vulnerability to me?
This vulnerability is an insecure direct object reference (IDOR) issue in the signing invitation acceptance process. It occurs when an attacker manipulates user-supplied object identifiers to access or modify resources they are not authorized to. This can lead to forged signatures and compromise the integrity and authenticity of documents involved in the signing process. The root cause is insufficient authorization validation on referenced resources during request processing.
How can this vulnerability impact me? :
The vulnerability can allow attackers to access or modify unauthorized resources, potentially forging signatures on documents. This compromises the integrity and authenticity of documents, which could lead to unauthorized approvals, legal issues, or loss of trust in the signing process.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability involves an insecure direct object reference (IDOR) that could allow unauthorized access or modification of resources, potentially leading to forged signatures and compromising document integrity and authenticity.
Such issues can impact compliance with standards and regulations like GDPR and HIPAA, which require strict controls over data access, integrity, and authenticity to protect personal and sensitive information.
By allowing unauthorized access or modification, this vulnerability could lead to violations of these regulations' requirements for data protection and auditability.