{"id":"CVE-2026-111417","kind":"vulnerability","aliases":["CVE-2026-111417"],"related":[],"title":"Foxit: shared token exposes other users' documents on HTML-to-PDF service","description":"A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.","summary":"Foxit's website HTML-to-PDF conversion service uses one shared token for all submitted conversion documents. An unauthorized user can reach documents that other people submitted.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"foxit.com HTML-to-PDF online conversion service","fixed":["2026-10-29 (server-side)"],"affected":"before 2026-10-29","ecosystem":"vendor"}],"ecosystems":[],"tags":["foxit","managed-hosting","pdf","saas","vendor"],"not_affected_if":["does-not-use-foxit-web-conversion"],"how_to_check":"Nothing to check on your side: it is a Foxit-hosted web service. If you sent documents to Foxit's online HTML-to-PDF converter before 2026-10-29, treat them as potentially exposed to others.","fix":"Fixed by Foxit on the hosted service on 2026-10-29; no customer action required. No version to install.","status":"open","published_at":"2026-10-29T10:17:03+00:00","first_seen_at":"2026-10-29T10:24:25+00:00","triaged_at":"2026-10-29T10:25:18+00:00","updated_at":"2026-10-29T10:26:27+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-10-29T10:25:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Foxit: shared token exposes other users' documents on HTML-to-PDF service","impact":"medium","summary":"Foxit's website HTML-to-PDF conversion service uses one shared token for all submitted conversion documents. An unauthorized user can reach documents that other people submitted.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["foxit","pdf","saas"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Documents submitted by other users can be read by an unauthorized party","analyst_note":"Check the Foxit advisory or NVD entry for scope, whether the service is still live, and whether the shared token has been rotated or removed.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["does-not-use-foxit-web-conversion"],"who_is_affected":"Only the Foxit-hosted HTML-to-PDF conversion service on Foxit's official website is described; the sources do not say whether self-hosted Foxit products are involved. Teams that send documents to that hosted service are the ones who could have had submissions exposed. Teams that do not use it can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000641,"input_tokens":4100,"output_tokens":461,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Foxit advisory or NVD entry for scope, whether the service is still live, and whether the shared token has been rotated or removed.","search":"'-111417':16A,19A '-2026':15A,18A 'access':65C,99C 'allow':95C 'broken':64C 'control':66C 'convers':42B,51B,79C,91C 'conversion':26A 'cve':14A,17A 'document':7A,52B,58B,92C,100C 'due':81C 'exist':68C 'expos':4A 'foxit':1A,28B,35B,71C 'foxit.com':20A 'host':31B 'html':10A,22A,39B,76C 'html-to-pdf':9A,21A,38B,75C 'manag':30B 'managed-host':29B 'may':94C 'offici':72C 'one':45B 'online':25A 'pdf':12A,24A,32B,41B,78C 'peopl':61B 'reach':57B 'saa':33B 'servic':13A,43B,80C 'service':27A 'share':2A,46B,87C 'submit':50B,62B,90C,101C 'to':23A 'token':3A,47B,88C 'unauthor':54B,96C 'use':44B,84C 'user':6A,55B,97C,104C 'vendor':34B 'vulner':67C 'websit':37B,73C","nicknames":[],"mitigations":[],"who_affected":"Only the Foxit-hosted online HTML-to-PDF conversion service on foxit.com is affected, and Foxit says it fixed it on 2026-10-29. Teams that submitted sensitive documents to that service before then may have had them exposed; the sources do not mention Foxit's desktop or self-hosted products. Teams that never used the online converter can skip this.","tier":"B","verified":{"fix":{"at":"2026-10-29T10:26:27Z","by":"analyst","doc":"https://www.foxit.com/support/security-bulletins/","run_id":1011}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-29T10:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss_by":"14984358-7092-470d-8f34-ade47a7658a2","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111417","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111417","severity":null,"published_at":"2026-10-29T10:17:03+00:00","modified_at":"2026-10-29T10:17:03+00:00","first_seen_at":"2026-10-29T10:24:25+00:00","fetched_at":"2026-10-29T10:24:25+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111417:1011","url":null,"severity":null,"published_at":"2026-10-29T10:26:27+00:00","modified_at":"2026-10-29T10:26:27+00:00","first_seen_at":"2026-10-29T10:26:27+00:00","fetched_at":"2026-10-29T10:26:27+00:00","note":"Foxit bulletin (2026-10-29) says broken access control/SSRF/hardcoded token issues in online HTML-to-PDF service are fixed server-side, no customer action. No exploitation or PoC found. Did not search social."}],"documents":[{"id":15803,"url":"https://www.foxit.com/support/security-bulletins/","title":"Foxit Security Bulletins: Security enhancements for Foxit online services (2026-10-29)","kind":"vendor","source":"analyst","publisher":null,"text":"Security enhancements for Foxit online services. Release date: October 29, 2026. Summary: Foxit has fixed broken access control, server-side request forgery (SSRF), and hardcoded API token exposure issues to enhance security. No customer action is required. Addressed potential broken access control and SSRF issues in the online HTML-to-PDF conversion service, which attackers could exploit to access or discover unintended resources under certain conditions. CVE-2026-111417.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":15807,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111417","title":"NVD CVE-2026-111417","kind":"advisory","source":"analyst","publisher":null,"text":"Broken access control in Foxit official website HTML-to-PDF conversion service due to shared token for submitted conversion documents. CNA Foxit CVSS 7.5 HIGH, CWE-639. Affected: foxit.com before 2026-10-29.","published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}