Foxit eSign CVE-2026-4947

Attacker must possess valid authenticated credentials to Foxit eSign platform (PR:L requirement). The vulnerability specifically affects the signing invitation acceptance workflow, meaning exploitation requires active signing processes where invitations have been issued to legitimate users. Attackers must identify or enumerate valid signing invitation object identifiers-this could occur through predictable ID patterns, information disclosure in invitation URLs, or observing invitation identifiers during legitimate use. The description states 'under certain conditions' without specifying exact configuration requirements, suggesting the vulnerability may depend on specific signing workflow configurations (e.g., multi-party signing, delegation features, or specific invitation types). No user interaction is required once the attacker has crafted the malicious request (UI:N). Exploitation is limited to authenticated users, which significantly reduces attack surface compared to unauthenticated remote vulnerabilities-organizational account security controls (password policies, MFA, access reviews) directly impact exploitability.

Real-world risk is MODERATE despite the 7.1 CVSS score. The CVSS vector (AV:N/AC:L/PR:L/UI:N) indicates network-accessible exploitation with low complexity, but requires authentication (PR:L), limiting the attack surface to compromised accounts or malicious insiders. The Confidentiality impact is High (C:H) while Integrity impact is only Low (I:L), though the description emphasizes signature forgery which typically represents high integrity impact-this apparent inconsistency suggests the CVSS scorer may have limited Integrity based on difficulty of successful exploitation or scope of modifiable data. EPSS probability of 0.03% (8th percentile) aligns with SSVC assessment (exploitation: none, automatable: no), indicating this vulnerability requires authenticated access and manual manipulation, making mass exploitation unlikely. No CISA KEV listing and no public POC reduce immediate risk. However, for organizations using Foxit eSign for legally binding documents, the integrity risk from signature forgery could have severe business and legal consequences despite low exploitation probability. Priority depends on organization's reliance on eSign for high-value transactions and existing account security controls.

An attacker with a valid low-privilege Foxit eSign account (such as a standard document signer or viewer) intercepts or enumerates signing invitation identifiers during normal use. The attacker crafts HTTP requests to the invitation acceptance endpoint, substituting their enumerated invitation IDs for ones legitimately sent to other users. Due to insufficient authorization validation, the application accepts the manipulated request and grants the attacker signer status on documents they were never authorized to sign. The attacker then completes the signing process, creating forged signatures that appear legitimate within the system, potentially approving contracts, financial documents, or legal agreements without proper authorization.