CVE-2026-24753: Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Secure Data Formsto a version that resolves this vulnerability.Fixed in 9.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24753?
The severity of CVE-2026-24753 is medium with a CVSS score of 6.5.
How do I fix CVE-2026-24753?
To fix CVE-2026-24753, you should upgrade Kiteworks Secure Data Forms to version 9.3.0 or later.
What type of vulnerability is CVE-2026-24753?
CVE-2026-24753 is an Authorization Bypass vulnerability due to Insecure Direct Object Reference.
Who is affected by CVE-2026-24753?
Authenticated users of Kiteworks Secure Data Forms prior to version 9.3.0 are affected by CVE-2026-24753.
What can attackers do with CVE-2026-24753?
Attackers can exploit CVE-2026-24753 to modify resources belonging to other users due to insufficient authorization checks.