CVE-2026-24755 Kiteworks IDOR Authorization Flaw in Secure Data Forms

Technical summary

CVE-2026-24755 is an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms prior to version 9.3.0. The root cause is insufficient authorization checks on resource ownership when processing permission modification requests. An authenticated attacker can directly reference and modify access controls on resources they do not own by manipulating request parameters or object identifiers, bypassing the intended access control logic. The CVSS 3.1 score of 5.4 (Medium) reflects network accessibility, low attack complexity, and a low attack surface (authenticated access required), with impacts to confidentiality and integrity.

Business impact

This vulnerability creates insider threat and data governance risks. A malicious insider or compromised account can silently alter permissions on shared data, potentially exposing sensitive customer, financial, or proprietary information to unintended parties, or denying legitimate users access to critical assets. For organizations using Kiteworks as a trust boundary for regulated data (healthcare, finance, legal), unauthorized permission changes violate audit trails and compliance controls, creating incident response and liability exposure. The indirect but plausible attack surface—social engineering to obtain legitimate credentials—increases real-world risk.

Affected systems

Kiteworks versions prior to 9.3.0 are affected. The Secure Data Forms feature is the specific attack vector. Organizations running any 9.x version before 9.3.0, or any earlier major version, should assume they are vulnerable. Check your Kiteworks deployment version in the admin console or system information logs.

Exploitability

Exploitation requires valid Kiteworks user credentials; unauthenticated access is not possible. Once authenticated, an attacker can modify permissions through standard API calls or web requests without requiring special privileges, complex tooling, or user interaction from victims. The low attack complexity and lack of user interaction make this a straightforward privilege escalation once credentials are obtained. The vulnerability is not known to be actively exploited in the wild (KEV status: not listed), but the simplicity of the attack and prevalence of credential compromise mean organizations should treat this as a practical risk.

Remediation

Upgrade Kiteworks to version 9.3.0 or later. Verify the upgrade path with Accellion's release notes to ensure no migration steps or downtime considerations are missed. In parallel, audit permission changes made on Secure Data Forms resources in the 30–90 days prior to patching to detect unauthorized modifications; Kiteworks audit logs should record all permission changes with user and timestamp. Review and re-validate permissions on highly sensitive shared data after patching.

Patch guidance

Accellion has released version 9.3.0 with authorization checks applied to resource ownership verification. Download and deploy 9.3.0 or any later stable version from the Kiteworks portal. Follow the vendor's upgrade documentation to schedule patching (many organizations will require maintenance windows). Test the upgrade in a non-production environment first to confirm no breaking changes to custom integrations or workflows. Coordinate timing with business stakeholders, as Secure Data Forms may be in active use during normal operations.

Detection guidance

Monitor Kiteworks audit logs for permission modification events, especially those modifying resources owned by different users than the requestor. Alert on any permission changes that grant or revoke access when the user requesting the change does not match the resource owner. Review API access logs if Kiteworks exposes detailed request logs. Watch for unusual patterns: a single user account rapidly changing permissions on many resources, or permission changes from off-hours or unusual IP addresses. Implement detective controls that flag cross-owner resource modifications for security review.

Why prioritize this

This is a medium-priority vulnerability. The CVSS score of 5.4 reflects moderate impact, but organizational context matters: if your Kiteworks deployment handles highly regulated or sensitive data (PII, trade secrets, healthcare records), treat it as higher priority. The fact that it requires authentication limits widespread exploitation, but insider threat scenarios and credential compromise increase likelihood. The simplicity of the attack and the sensitive nature of data managed by Kiteworks suggest scheduling the patch within 30 days rather than deferring it to routine maintenance cycles.

Risk score, explained

The CVSS 3.1 score of 5.4 (Medium) reflects: (1) Network-accessible attack surface (AV:N), (2) Low attack complexity—no special conditions required once authenticated (AC:L), (3) Requirement for prior authentication (PR:L), (4) No user interaction needed from the victim (UI:N), (5) Scope unchanged—the vulnerability is confined to the Kiteworks application (S:U), (6) Low confidentiality impact—an attacker can view data they should not access (C:L), (7) Low integrity impact—permissions can be altered but not the data itself (I:L), and (8) No availability impact (A:N). The score appropriately reflects that this is a serious but not critical authorization flaw.

Frequently asked questions