CVE-2026-24753
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership.
Risk Assessment
An authenticated attacker can unauthorizedly modify other users' data, potentially leading to data integrity and confidentiality breaches.
Recommendation
Upgrade Kiteworks to version 9.3.0 or later, which contains the patch.
Other vulnerabilities in Kiteworks
See all- CVE-2026-24782High
Multiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms. An authenticated attacker with the FormBuilder role can read and modify other users' form definitions and global configuration parameters.
- CVE-2026-24761Low
In Kiteworks prior to version 9.3.0, an IDOR vulnerability was found. An authenticated user can access metadata of other users' resources due to insufficient authorization checks.
- CVE-2026-24756Medium
An Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms prior to version 9.3.0 allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks.
- CVE-2026-24755Medium
Kiteworks prior to version 9.3.0 has an IDOR vulnerability in Secure Data Forms, allowing an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks.
- CVE-2026-24754Medium
Kiteworks prior to version 9.3.0 has a stored XSS vulnerability in Secure Data Forms, allowing an authenticated attacker to execute arbitrary JavaScript code in other users' sessions.
- CVE-2026-24752High
Reflected XSS vulnerability in Kiteworks Secure Data Forms prior to version 9.3.0. An external attacker can trick a user into executing arbitrary JavaScript code via a crafted link.
- CVE-2026-24751High
Kiteworks prior to version 9.3.0 has a reflected XSS vulnerability in Secure Data Forms, allowing an external attacker to trick a user into executing arbitrary JavaScript code. Fixed in version 9.3.0.
- CVE-2026-23638Medium
Kiteworks prior to version 9.3.0 has an IDOR vulnerability in Secure Data Forms. An authenticated attacker can modify approval flow configurations of other users' forms due to insufficient authorization checks on resource ownership.
Original NVD description (English source)
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.