CVE-2026-24782 — Kiteworks Secure Data Forms has a SQL Injection vulnerability

CVE-2026-24782

Kiteworks Secure Data Forms has a SQL Injection vulnerability PUBLISHED

Description (CNA)

Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

Affected (CNA)

Vendor / product	Versions
kiteworks / Secure Data Forms	affected < 9.3.0

CWE

CWE-89

References

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-849r-gm3r-4v5c

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.