CVE-2026-24761CWE-639

Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key

Low · published June 1, 2026

CVSS v3.1
3.7
EPSS
0%
Percentile
3.2
In the wild
Unconfirmed
What it is

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to access metadata of resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

The record
Technical detail
CVSS v3.1
3.7 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00142 · 3.2th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-06-01T21:52Z
EPSS history
Timeline
  • 01 JUN 21:52Z
    Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key
    cvelistv5