This vulnerability is an improper access control issue (CWE-284) identified in Foxit Software Inc.'s na1.foxitesign.foxit.com platform. It arises from insufficient authorization checks during the signing invitation acceptance process, enabling an attacker to exploit insecure direct object references (IDOR) by manipulating user-supplied object identifiers. This flaw could allow unauthorized access or modification of resources, potentially resulting in forged digital signatures and undermining the integrity and authenticity of documents. The vulnerability affects versions prior to 2026-03-26 and carries a CVSS 3.1 score of 7.1, indicating high severity. There are no known exploits in the wild, and no explicit vendor advisory or patch information is provided.

The vulnerability could allow attackers with limited privileges to access or modify resources they should not be authorized to, specifically in the signing invitation acceptance process. This could lead to forged signatures, compromising the integrity and authenticity of signed documents. There is no indication of availability impact. No known exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, organizations should review access controls around the signing invitation acceptance process and monitor for suspicious activity related to object identifier manipulation. Avoid relying solely on user-supplied identifiers for authorization decisions.