CVE-2026-24753: Kiteworks IDOR Vulnerability in Secure Data Forms – Patch to 9.3.0

Technical summary

CVE-2026-24753 is an IDOR vulnerability (CWE-639) in Kiteworks Secure Data Forms that affects versions prior to 9.3.0. The vulnerability arises from insufficient authorization controls on resource ownership verification. When an authenticated user submits a request to modify a resource, the application fails to properly validate that the requesting user has ownership or explicit permission to modify that specific resource. An attacker with valid credentials can exploit this by crafting requests with object references belonging to other users, allowing unauthorized modification of those resources. The attack surface is network-accessible and requires valid authentication credentials to exploit.

Business impact

This vulnerability poses a direct threat to data integrity within Kiteworks deployments. Authenticated users—whether internal staff with low privileges or compromised external accounts—can alter forms, templates, or other resources created by colleagues or administrators without authorization. In a Secure Data Forms context, this could lead to modification of data collection workflows, form logic, or sensitive configuration. The integrity impact is high; confidentiality and availability are not directly compromised. Organizations relying on Kiteworks for regulated data workflows may face compliance concerns if resource tampering goes undetected, as audit trails would show unauthorized modifications.

Affected systems

The vulnerability affects Kiteworks (by Accellion) Secure Data Forms in all versions prior to version 9.3.0. Organizations running older versions of Kiteworks should treat this as an immediate remediation target. The vulnerability requires an authenticated session, so it does not pose a risk to unauthenticated systems or networks without Kiteworks deployment.

Exploitability

Exploitation requires a valid authenticated session—an attacker cannot exploit this vulnerability from an unauthenticated state. However, once authenticated, exploitation is straightforward: the attacker needs only to identify or guess resource identifiers belonging to other users and submit modification requests. No complex attack chains, social engineering, or user interaction is required. The CVSS 3.1 score of 6.5 (MEDIUM) reflects the requirement for authentication coupled with the high integrity impact. The attack vector is network-based, meaning exploitation can occur remotely without physical access.

Remediation

Upgrade Kiteworks to version 9.3.0 or later. This patch version includes authorization control fixes that properly validate resource ownership before permitting modifications. Organizations should verify patch applicability in the official Kiteworks release notes and schedule upgrades during a maintenance window to avoid service disruption. Pre-upgrade testing in a non-production environment is recommended.

Patch guidance

To remediate CVE-2026-24753, upgrade your Kiteworks deployment to version 9.3.0 or any subsequent release. Consult the Accellion/Kiteworks vendor advisory and release notes to confirm patch availability and any prerequisites for your specific deployment configuration (on-premises, cloud-hosted, etc.). Plan the upgrade carefully, as it may require service restarts. After patching, validate that authorization controls are functioning correctly by testing that users cannot modify resources belonging to other users.

Detection guidance

Monitor Kiteworks audit logs for suspicious resource modification activities, particularly modifications by users to resources they did not create or should not have access to. Look for patterns of cross-user modifications or a single user modifying a large number of resources in a short time window. Network detection can focus on HTTP requests containing unusual object identifiers in modification endpoints. Once patched, baseline normal modification patterns to establish a detection baseline. If available, enable verbose logging on Secure Data Forms endpoints during the interim period before patching.

Why prioritize this

This vulnerability should be prioritized for patching due to several factors: (1) It requires only authentication, not complex exploitation; (2) The impact on data integrity is high, potentially affecting business-critical workflows; (3) Kiteworks is often used for regulated data handling, making unauthorized modifications a compliance concern; (4) The vulnerability is in a widely-used feature (Secure Data Forms); and (5) Patch availability exists, making remediation straightforward. While not in active exploitation (KEV status is false), the relative ease of exploitation post-authentication warrants near-term patching.

Risk score, explained

The CVSS 3.1 score of 6.5 (MEDIUM) reflects a balanced risk profile: Attack Vector (Network) and Attack Complexity (Low) elevate risk, as does the high Impact on Integrity. However, the requirement for Privileges (authenticated user) and absence of Confidentiality or Availability impact constrain the score. In practice, organizational risk may be higher if Kiteworks is used in high-sensitivity workflows or if the user base includes many external or lower-privileged accounts that could be compromised.

Frequently asked questions