CVE-2026-102121

HighCVSS 8.6

Published: 30/09/2026(UTC)Updated: 08/10/2026(UTC)Translated: 01/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

20th percentile - higher than 20% of all known CVEs

Summary

A form-rendering interface in Advanced Forms is reachable without authentication but returned more data than required. Anyone knowing the URL of a published form could retrieve the owner's profile and parts of deployment configuration; no passwords or tokens were exposed.

Risk Assessment

Risk of exposing personal data and configuration details, potentially aiding further attacks.

Recommendation

Restrict access to public forms and verify no excessive data is returned.

Other vulnerabilities in Kiteworks Advanced Forms

CVE-2026-102150High
A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form submissions.

Original NVD description (English source)

A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve the form owner's Kiteworks account profile, including personal details, along with parts of the deployment's configuration settings; no passwords, authentication tokens, or multi-factor secrets were exposed.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS