CVE-2026-24756: CWE-639: Authorization Bypass Through User-Controlled Key in kiteworks Secure Data Forms
An authorization bypass vulnerability (CWE-639) exists in Kiteworks Secure Data Forms versions prior to 9. 3. 0. This Insecure Direct Object Reference (IDOR) flaw allows an authenticated user to modify resources owned by other users due to insufficient authorization checks. The vulnerability has a CVSS 3. 1 base score of 4. 3, indicating medium severity. A patch is available in Kiteworks version 9. 3. 0 and later to address this issue.
AI Analysis
Technical Summary
CVE-2026-24756 is an authorization bypass vulnerability in Kiteworks Secure Data Forms before version 9.3.0. It arises from insufficient verification of resource ownership, enabling authenticated users to modify other users' resources via user-controlled keys. This is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability has a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting network attack vector, low attack complexity, and requiring low privileges with no user interaction. The impact is limited to integrity loss without confidentiality or availability impact. No known exploits in the wild have been reported. Upgrading to version 9.3.0 or later mitigates the vulnerability.
Potential Impact
The vulnerability allows an authenticated user to modify resources belonging to other users, resulting in a loss of data integrity. There is no impact on confidentiality or availability. The medium CVSS score reflects the moderate risk due to the requirement for authentication and low privileges. No known active exploitation has been reported.
Mitigation Recommendations
Upgrade Kiteworks Secure Data Forms to version 9.3.0 or later to apply the official patch that fixes this authorization bypass vulnerability. Since this is not a cloud service, remediation depends on applying the vendor's update. Patch status is confirmed by the vendor advisory indicating the fix is included in version 9.3.0. No additional mitigation steps are specified.
CVE-2026-24756: CWE-639: Authorization Bypass Through User-Controlled Key in kiteworks Secure Data Forms
Description
An authorization bypass vulnerability (CWE-639) exists in Kiteworks Secure Data Forms versions prior to 9. 3. 0. This Insecure Direct Object Reference (IDOR) flaw allows an authenticated user to modify resources owned by other users due to insufficient authorization checks. The vulnerability has a CVSS 3. 1 base score of 4. 3, indicating medium severity. A patch is available in Kiteworks version 9. 3. 0 and later to address this issue.
CVSS v3.1
Score 4.3medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-24756 is an authorization bypass vulnerability in Kiteworks Secure Data Forms before version 9.3.0. It arises from insufficient verification of resource ownership, enabling authenticated users to modify other users' resources via user-controlled keys. This is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). The vulnerability has a CVSS 3.1 score of 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting network attack vector, low attack complexity, and requiring low privileges with no user interaction. The impact is limited to integrity loss without confidentiality or availability impact. No known exploits in the wild have been reported. Upgrading to version 9.3.0 or later mitigates the vulnerability.
Potential Impact
The vulnerability allows an authenticated user to modify resources belonging to other users, resulting in a loss of data integrity. There is no impact on confidentiality or availability. The medium CVSS score reflects the moderate risk due to the requirement for authentication and low privileges. No known active exploitation has been reported.
Mitigation Recommendations
Upgrade Kiteworks Secure Data Forms to version 9.3.0 or later to apply the official patch that fixes this authorization bypass vulnerability. Since this is not a cloud service, remediation depends on applying the vendor's update. Patch status is confirmed by the vendor advisory indicating the fix is included in version 9.3.0. No additional mitigation steps are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-01-26T19:06:16.060Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a1e08c8e29bf47b5051e319
Added to database: 6/1/2026, 10:33:44 PM
Last enriched: 6/1/2026, 10:49:17 PM
Last updated: 6/2/2026, 6:19:16 AM
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.