CVE-2026-111417: Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service
Published Oct 29, 2026
·Updated
A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.
Affected Software
1 affected component
Foxit HTML-to-PDF conversion service
Event History
Oct 29, 2026
CVE Published
via MITRE·09:45 AM
Data Sourced
via MITRE·09:45 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploiting this issue require an account or interaction from another user?
No. The CVSS vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
2
What is the expected security impact if the issue is exploited?
The issue may expose documents submitted by other users to the conversion service. The CVSS assessment indicates high confidentiality impact, with no indicated integrity or availability impact.