CVE-2026-4947CWE-284

Insecure Direct Object Reference (IDOR) Leading to Signature Forgery in Foxit eSign

High · published April 1, 2026

CVSS v3.1
7.1
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

Addressed a potential insecure direct object reference (IDOR) vulnerability in the signing invitation acceptance process. Under certain conditions, this issue could have allowed an attacker to access or modify unauthorized resources by manipulating user-supplied object identifiers, potentially leading to forged signatures and compromising the integrity and authenticity of documents undergoing the signing process. The issue was caused by insufficient authorization validation on referenced resources during request processing.

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00290 · 20.4th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-04-01T01:40Z
EPSS history
Timeline
  • 01 APR 01:40Z
    Insecure Direct Object Reference (IDOR) Leading to Signature Forgery in Foxit eSign
    cvelistv5