CVE-2026-24761: Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to access metadata of resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kiteworks Secure Data Formsto a version that resolves this vulnerability.Fixed in 9.3.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24761?
The severity of CVE-2026-24761 is rated as medium with a score of 4.3.
How do I fix CVE-2026-24761?
To fix CVE-2026-24761, upgrade Kiteworks Secure Data Forms to version 9.3.0 or higher.
What does CVE-2026-24761 affect?
CVE-2026-24761 affects the Kiteworks Secure Data Forms software prior to version 9.3.0.
What type of vulnerability is CVE-2026-24761?
CVE-2026-24761 is an Authorization Bypass vulnerability resulting from insufficient authorization checks.
Who can exploit CVE-2026-24761?
An authenticated user can exploit CVE-2026-24761 to access metadata of resources belonging to other users.