Kiteworks Secure Data Forms vulnerabilities

CVE-2026-24782 [HIGH] CWE-89 CVE-2026-24782: Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilit Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 o

CVE-2026-102091 [HIGH] CWE-918 CVE-2026-102091: Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that c Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only services or other network-restricted resources.

CVE-2026-102121 [HIGH] CWE-200 CVE-2026-102121: A form-rendering interface in the Advanced Forms component is reachable without authentication so th A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve the form owner's Kiteworks account profile, including pe

CVE-2026-23636 [HIGH] CWE-434 CVE-2026-23636: Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, th Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, the manager of a form could potentially exploit an Unrestricted Upload of File with Dangerous Type due to a missing validation. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

CVE-2026-102150 [HIGH] CWE-306 CVE-2026-102150: A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauth A function in the Kiteworks Advanced Forms component was reachable without authentication. An unauthenticated attacker could potentially use it to carry out a limited set of internal service operations on the Kiteworks platform; it did not permit access to user accounts, stored files, or form submissions.

CVE-2026-102109 [HIGH] CWE-89 CVE-2026-102109: A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the A SQL injection vulnerability existed in Kiteworks Secure Data Forms, where a value derived from the authenticated user's stored account data was incorporated into a database query without proper sanitization. An authenticated user could potentially influence that value to inject SQL. Exploitation requires an authenticated session and applies only to

CVE-2026-24751 [HIGH] CWE-79 CVE-2026-24751: Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVE-2026-24752 [HIGH] CWE-79 CVE-2026-24752: Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks is a private data network (PDN). Prior to version 9.3.0, a reflected XSS vulnerability in Kiteworks Secure Data Forms could allow an external attacker to trick a user into executing arbitrary JavaScript code. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVE-2026-23635 [MEDIUM] CWE-523 CVE-2026-23635: Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, a misconfiguration of the security attributes could potentially lead to Unprotected Transport of Credentials under certain circumstances. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

CVE-2026-23638 [MEDIUM] CWE-639 CVE-2026-23638: Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Referen Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated attacker to tamper with the internal approval flow configurations of forms belonging to other users due to insufficient authorization checks on resource ownership. Upgrade

CVE-2026-24753 [MEDIUM] CWE-639 CVE-2026-24753: Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Referen Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a p

CVE-2026-24755 [MEDIUM] CWE-639 CVE-2026-24755: Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Referen Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later

CVE-2026-24750 [MEDIUM] CWE-79 CVE-2026-24750: Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an Kiteworks is a private data network (PDN). In Kiteworks Secure Data Forms prior to version 9.2.1, an authenticated attacker could exploit an Improper Neutralization of Input During Web Page Generation as Stored XSS when modifying forms. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.

CVE-2026-24756 [MEDIUM] CWE-639 CVE-2026-24756: Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Referen Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a p

CVE-2026-24761 [MEDIUM] CWE-639 CVE-2026-24761: Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Referen Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to access metadata of resources belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to