CVE-2026-24753

Vulnerability

An Insecure Direct Object Reference (IDOR) vulnerability exists in Kiteworks Secure Data Forms prior to version 9.3.0. This flaw stems from insufficient authorization checks on resource ownership, allowing authenticated users to modify resources belonging to other users [1].

Exploitation

An authenticated attacker can exploit this vulnerability by manipulating resource identifiers to access and modify data belonging to other users. The vulnerability requires the attacker to be logged into the Kiteworks system and have knowledge of or the ability to guess resource identifiers [1].

Impact

Successful exploitation allows an authenticated attacker to tamper with the workspace of another user. This could lead to unauthorized modification or deletion of sensitive data, depending on the specific resources targeted [1].

Mitigation

Kiteworks has released version 9.3.0 to address this vulnerability. Users are advised to upgrade to Kiteworks version 9.3.0 or later to receive the patch. No workarounds are mentioned in the available references [1].