Medium severity · published Jun 1, 2026
CVE-2026-24755
Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key
5.4
CVSS
0.1%
EPSS
No
On KEV
Description
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 3% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Secure Data Forms · kiteworks
< 9.3.0 · source: vendor
KI
Kiteworks · Accellion
before 9.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-24755
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-24755
Vendor Advisory
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-f8rf-7jq6-gch9
More from Secure Data Forms
8.8
CVE-2026-24782
Kiteworks Secure Data Forms has a SQL Injection vulnerability
8.6
CVE-2026-102121
Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor
8.2
CVE-2026-24752
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
8.2
CVE-2026-24751
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
7.5
CVE-2026-102091
Kiteworks Secure Data Forms server-side request forgery