What is CVE-2026-4947?

CVE-2026-4947 is a high-severity vulnerability in Foxit Esign, classified under Improper Access Control. CVSS score: 7.1/10. Published 2026-04-01.

How severe is CVE-2026-4947?

High severity. CVSS v3 base score is 7.1 out of 10.

Vulnerability in Foxit Esign

CVE-2026-4947

Addressed a potential insecure direct object reference (IDOR) vulnerability in the signing invitation acceptance process. Under certain conditions, this issue could have allowed an attacker to access or modify unauthorized resources by manipulating user-supplied object identifiers, potentially leading to forged signatures and compromising the integrity and authenticity of documents undergoing the signing process. The issue was caused by insufficient authorization validation on referenced resources during request processing.

EPSS: 0.002 (7.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.1 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N.

Affected products

Foxit Esign
Foxit Software Inc. Na1.foxitesign.foxit.com — versions before 2026-03-26

Weakness classification (CWE)

CWE-284 — Improper Access Control

References

14984358-7092-470d-8f34-ade47a7658a2 (Vendor Advisory)

Frequently asked questions

What is CVE-2026-4947?: CVE-2026-4947 is a high-severity vulnerability in Foxit Esign, classified under Improper Access Control. CVSS score: 7.1/10. Published 2026-04-01.
How severe is CVE-2026-4947?: High severity. CVSS v3 base score is 7.1 out of 10.