CVE-2026-24755: Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Secure Data Formsto a version that resolves this vulnerability.Fixed in 9.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24755?
The severity of CVE-2026-24755 is classified as medium with a score of 5.4.
How do I fix CVE-2026-24755?
To fix CVE-2026-24755, upgrade Kiteworks Secure Data Forms to version 9.3.0 or later.
What type of vulnerability is CVE-2026-24755?
CVE-2026-24755 is an Authorization Bypass vulnerability caused by insufficient authorization checks.
Which products are affected by CVE-2026-24755?
CVE-2026-24755 affects Kiteworks Secure Data Forms prior to version 9.3.0.
Can CVE-2026-24755 allow unauthorized access to user data?
Yes, CVE-2026-24755 can allow an authenticated user to modify permissions on resources belonging to other users.