CVE-2026-24782

Vulnerability

Multiple SQL Injection vulnerabilities exist in Kiteworks Secure Data Forms prior to version 9.3.0. These flaws allow for unauthorized access to and modification of other users' form definitions, as well as certain global configuration parameters [1].

Exploitation

An authenticated attacker with the FormBuilder role can exploit these vulnerabilities. The attacker needs to have this specific role assigned to them to trigger the SQL injection flaws and gain access to sensitive form definitions and configuration settings [1].

Impact

Successful exploitation allows an attacker to retrieve information about or modify other users' form definitions. Additionally, the attacker can alter some global configuration parameters. This could lead to unauthorized data access, configuration tampering, and potential disruption of services [1].

Mitigation

Kiteworks has released version 9.3.0, which includes a patch for these vulnerabilities. Users are advised to upgrade to version 9.3.0 or later to remediate the issue [1].