CVE-2026-24755 — Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

CVE-2026-24755

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key PUBLISHED

Description (CNA)

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

Affected (CNA)

Vendor / product	Versions
kiteworks / Secure Data Forms	affected < 9.3.0

CWE

CWE-639

References

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-f8rf-7jq6-gch9

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.