The Advanced Forms component in Kiteworks Secure Data Forms has a form-rendering interface accessible without authentication. This interface returns excessive information beyond the form itself, including the form owner's Kiteworks account profile with personal details and parts of the deployment's configuration. No passwords, authentication tokens, or multi-factor authentication secrets are disclosed. The vulnerability affects versions from 0 up to but not including 9.5.1. The CVSS 3.1 base score is 8.6, reflecting high severity due to the exposure of sensitive information without authentication.

An attacker who knows the URL of a published form can retrieve sensitive personal details of the form owner and some deployment configuration information without any authentication. While no credentials or authentication secrets are exposed, the leakage of personal and configuration data could aid further reconnaissance or targeted attacks.

No patch or official fix information is provided in the advisory. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to published form URLs or monitor for unauthorized access attempts as a precaution.