CVE-2026-111417 PUBLISHED

Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service

Assigner: Foxit
Reserved: 16.10.2026 Published: 29.10.2026 Updated: 29.10.2026

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Foxit Software Inc.
Product	foxit.com
Versions	Default: unaffected Version before 2026-10-29 is affected

Credits

Suraj Gupta finder

References

https://www.foxit.com/support/security-bulletins.html

Problem Types

CWE-639: Authorization Bypass Through User-Controlled Key CWE

Impacts

Information Disclosure