Shared Token Breaks Access Control in PDF Conversion Service

A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the use of a shared token for submitted conversion documents. This may allow unauthorized users to access documents submitted by other users.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability represents a critical failure in access control implementation within Foxit's HTML-to-PDF conversion service. By reusing a single shared token across multiple document conversion requests, the service creates an authentication bypass that allows any user to access documents submitted by other users. This affects organizations and individuals relying on Foxit's conversion service for sensitive document processing, including legal firms, financial institutions, and enterprises handling confidential materials. The vulnerability is particularly dangerous because it violates fundamental access control principles—users can inadvertently expose proprietary information, personal data, or trade secrets simply by using what appears to be a legitimate service.

Casky.ai's 283 matched skills identify this vulnerability by detecting the attack patterns mapped to MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). The platform's Claude AI-powered extended reasoning capabilities recognize the broken access control indicators: anomalous token reuse across different user sessions, unauthorized document retrieval attempts, and permission logic failures. Practitioners using Casky would see findings highlighting suspicious token behavior patterns, cross-user data access attempts, and failures in session isolation—enabling them to spot similar architectural flaws in their own systems before exploitation occurs. This proactive detection maps directly to how attackers chain access control bypasses with credential harvesting to escalate privileges and exfiltrate data.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-111417.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-111417

Casky has 283 skills that investigate the attack patterns behind CVE-2026-111417. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn