CVE-2026-24761

Vulnerability

An Insecure Direct Object Reference (IDOR) vulnerability exists in Kiteworks Secure Data Forms versions prior to 9.3.0. This flaw stems from insufficient authorization checks on resource ownership, allowing authenticated users to access metadata of resources belonging to other users [1].

Exploitation

An authenticated attacker can exploit this vulnerability by sending a crafted request to access resource metadata. The vulnerability is triggered due to insufficient authorization checks on resource ownership, allowing the attacker to bypass these checks and view information they should not have access to [1].

Impact

Successful exploitation of this vulnerability allows an authenticated attacker to reveal the email notification configuration and other metadata of another user's resources. This leads to unauthorized information disclosure regarding user data and system configurations [1].

Mitigation

Kiteworks has released version 9.3.0 to address this vulnerability. Users are advised to upgrade to Kiteworks version 9.3.0 or later to receive the patch. No workarounds are mentioned in the available references [1].