CVE-2026-24755: CWE-639: Authorization Bypass Through User-Controlled Key in kiteworks Secure Data Forms
CVE-2026-24755 is an authorization bypass vulnerability in Kiteworks Secure Data Forms prior to version 9. 3. 0. It allows an authenticated user to modify permissions on resources owned by other users due to insufficient authorization checks. This issue is classified as an Insecure Direct Object Reference (IDOR) and is tracked under CWE-639. The vulnerability has a medium severity with a CVSS score of 5. 4. A patch is available in Kiteworks version 9. 3. 0 and later.
AI Analysis
Technical Summary
Kiteworks Secure Data Forms versions before 9.3.0 contain an IDOR vulnerability (CWE-639) that permits authenticated users to bypass authorization controls by manipulating user-controlled keys. This flaw enables modification of permissions on resources belonging to other users, violating proper access control mechanisms. The vulnerability is network exploitable with low attack complexity and requires user privileges but no user interaction. Confidentiality and integrity impacts are limited, with no availability impact reported. The vendor has released version 9.3.0 to address this issue.
Potential Impact
An authenticated user can alter permissions on resources they do not own, potentially leading to unauthorized access or modification of data within the Kiteworks Secure Data Forms environment. The impact affects confidentiality and integrity to a limited degree but does not affect availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade Kiteworks Secure Data Forms to version 9.3.0 or later to apply the official patch that fixes this authorization bypass vulnerability. Since this is not a cloud service, remediation depends on the user applying the update. Patch status is confirmed by the vendor advisory indicating the fix is included in version 9.3.0.
CVE-2026-24755: CWE-639: Authorization Bypass Through User-Controlled Key in kiteworks Secure Data Forms
Description
CVE-2026-24755 is an authorization bypass vulnerability in Kiteworks Secure Data Forms prior to version 9. 3. 0. It allows an authenticated user to modify permissions on resources owned by other users due to insufficient authorization checks. This issue is classified as an Insecure Direct Object Reference (IDOR) and is tracked under CWE-639. The vulnerability has a medium severity with a CVSS score of 5. 4. A patch is available in Kiteworks version 9. 3. 0 and later.
CVSS v3.1
Score 5.4medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Kiteworks Secure Data Forms versions before 9.3.0 contain an IDOR vulnerability (CWE-639) that permits authenticated users to bypass authorization controls by manipulating user-controlled keys. This flaw enables modification of permissions on resources belonging to other users, violating proper access control mechanisms. The vulnerability is network exploitable with low attack complexity and requires user privileges but no user interaction. Confidentiality and integrity impacts are limited, with no availability impact reported. The vendor has released version 9.3.0 to address this issue.
Potential Impact
An authenticated user can alter permissions on resources they do not own, potentially leading to unauthorized access or modification of data within the Kiteworks Secure Data Forms environment. The impact affects confidentiality and integrity to a limited degree but does not affect availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade Kiteworks Secure Data Forms to version 9.3.0 or later to apply the official patch that fixes this authorization bypass vulnerability. Since this is not a cloud service, remediation depends on the user applying the update. Patch status is confirmed by the vendor advisory indicating the fix is included in version 9.3.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-01-26T19:06:16.060Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1e08c8e29bf47b5051e316
Added to database: 6/1/2026, 10:33:44 PM
Last enriched: 6/1/2026, 10:49:21 PM
Last updated: 6/2/2026, 7:12:15 AM
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.