CVE-2026-24782
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Multiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms. An authenticated attacker with the FormBuilder role can read and modify other users' form definitions and global configuration parameters.
Risk Assessment
An attacker can gain unauthorized access to data and change global configuration, compromising the security of the entire system.
Recommendation
Upgrade Kiteworks to version 9.3.0 or later.
Other vulnerabilities in Kiteworks
See all- CVE-2026-24761Low
In Kiteworks prior to version 9.3.0, an IDOR vulnerability was found. An authenticated user can access metadata of other users' resources due to insufficient authorization checks.
- CVE-2026-24756Medium
An Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms prior to version 9.3.0 allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks.
- CVE-2026-24755Medium
Kiteworks prior to version 9.3.0 has an IDOR vulnerability in Secure Data Forms, allowing an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks.
- CVE-2026-24754Medium
Kiteworks prior to version 9.3.0 has a stored XSS vulnerability in Secure Data Forms, allowing an authenticated attacker to execute arbitrary JavaScript code in other users' sessions.
- CVE-2026-24753Medium
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership.
- CVE-2026-24752High
Reflected XSS vulnerability in Kiteworks Secure Data Forms prior to version 9.3.0. An external attacker can trick a user into executing arbitrary JavaScript code via a crafted link.
- CVE-2026-24751High
Kiteworks prior to version 9.3.0 has a reflected XSS vulnerability in Secure Data Forms, allowing an external attacker to trick a user into executing arbitrary JavaScript code. Fixed in version 9.3.0.
- CVE-2026-23638Medium
Kiteworks prior to version 9.3.0 has an IDOR vulnerability in Secure Data Forms. An authenticated attacker can modify approval flow configurations of other users' forms due to insufficient authorization checks on resource ownership.
Original NVD description (English source)
Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.