The vulnerability is an insecure direct object reference that permits an attacker to manipulate object identifiers during the signing invitation acceptance process. This allows unauthorized access or modification of resources, potentially resulting in forged signatures and compromising the integrity and authenticity of documents. The weakness falls under access control failure (CWE-284).

Affected systems include Foxit eSign (platform foxitesign.foxit.com) as listed by the CNA. No explicit version information is provided, so all instances of the platform that process signing invitations may be susceptible until a patch is applied.

The CVSS score of 7.1 indicates moderate to high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at this time. The vulnerability is not currently catalogued in the CISA KEV list. Likely attack vectors involve remote web requests where attackers manipulate resource identifiers; the vulnerability can be leveraged without additional prerequisites beyond sending a crafted request. Mitigation requires applying the vendor’s patch or upgrade, enforcing proper authorization checks on all referenced resources, and monitoring for suspicious activity to prevent forged signatures.