Kiteworks Secure Data Forms CVE-2026-24756

Exploitation requires a valid authenticated session on the Kiteworks platform with at minimum a low-privileged user account (confirmed by CVSS PR:L). The vulnerability is specific to the Secure Data Forms feature - users or deployments that do not use this feature are not exposed. No special platform configuration, elevated role, or non-default settings are required beyond having an active account. Exploitation is bounded to integrity impact only: an attacker can modify but not read confidential data from other users (C:N per CVSS), and cannot cause service disruption (A:N). The primary limiting factor is the authentication requirement, which restricts exploitation to internal users, compromised accounts, or malicious insiders - external unauthenticated attackers cannot exploit this directly.

The CVSS base score of 4.3 (Medium) reflects a network-accessible, low-complexity attack requiring only a low-privileged account (PR:L), with impact limited strictly to integrity (I:L) - no confidentiality breach (C:N) and no availability impact (A:N). EPSS data was not provided in the source intelligence, so exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog and no POC is identified, indicating this is not being actively targeted at scale at time of analysis. Despite the moderate CVSS score, the real-world risk is context-dependent: in multi-tenant environments or regulated industries (healthcare, legal, finance) where Kiteworks is used to isolate form submissions between parties, unauthorized cross-user modification could violate data integrity controls and compliance requirements. The attack is fully internal - exploitation is bounded by the requirement for a valid platform account, limiting exposure from unauthenticated external actors.

An authenticated Kiteworks user with a standard low-privileged account navigates to the Secure Data Forms interface, captures a legitimate API request for one of their own form resources, and replaces the resource identifier with an ID belonging to another user's form submission. Because the server performs no ownership validation, the modification is accepted and committed, overwriting the victim's data without any authorization error. No public exploit code has been identified, but the technique requires only basic HTTP request manipulation and is trivially reproducible by any authenticated user who enumerates or guesses valid resource IDs.