Kiteworks
CVE-2026-24782
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable authenticated FormBuilder role gives PR:L/AC:L; SQLi enables broad read (C:H) and write (I:H), but availability impact is only plausible (A:L), not demonstrated.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
AnalysisAI
SQL injection in Kiteworks Secure Data Forms lets an authenticated user holding the FormBuilder role read and tamper with other tenants' form definitions and a subset of global configuration parameters in the Kiteworks Private Data Network prior to version 9.3.0. The flaw crosses the intended per-user data boundary via crafted input to the FormBuilder feature, yielding high confidentiality and integrity impact. There is no public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC rates exploitation as none.
Technical ContextAI
Kiteworks is a Private Data Network (PDN) appliance/platform used for governed file sharing, secure managed file transfer, and email/data governance. The affected component is the Secure Data Forms 'FormBuilder' subsystem (CPE cpe:2.3:a:kiteworks:secure_data_forms), which lets privileged users construct and manage data-collection form definitions. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): user-controllable input reaching the FormBuilder logic is concatenated into SQL statements without adequate parameterization, so an attacker can alter query structure to read or write rows belonging to other users' form definitions and certain global settings. Because multiple injection points are cited, the exposure is a systemic input-handling weakness in this module rather than a single tainted parameter.
RemediationAI
Vendor-released patch: Kiteworks 9.3.0 - upgrade the Kiteworks platform to version 9.3.0 or later, which remediates the Secure Data Forms SQL injection issues, per the vendor advisory at https://github.com/kiteworks/security-advisories/security/advisories/GHSA-849r-gm3r-4v5c. Until the upgrade is applied, reduce exposure by tightly restricting who is granted the FormBuilder role (revoke it from any account that does not actively build forms) and by auditing FormBuilder activity logs for anomalous form-definition or configuration changes; the trade-off is reduced self-service form authoring for legitimate users. Because exploitation requires an authenticated FormBuilder account, enforcing least privilege on that role and enabling MFA/strong credential hygiene on those accounts meaningfully lowers risk without disrupting other platform functions.
An access control vulnerability exists in Kiteworks Core versions 9.2.0 and 9.2.1 that allows authenticated users to acc
Accellion Kiteworks before 7.4.0 allows an authenticated user to perform SQL Injection via LDAPGroup Search. Rated high
Reflected cross-site scripting in Kiteworks Secure Data Forms (versions prior to 9.3.0) allows remote unauthenticated at
Reflected cross-site scripting in Kiteworks Secure Data Forms prior to version 9.3.0 allows external attackers to execut
Kiteworks Email Protection Gateway prior to version 9.2.0 contains a stored cross-site scripting vulnerability in its co
A stored cross-site scripting (XSS) vulnerability exists in Kiteworks Secure Data Forms that allows authenticated attack
Accellion Kiteworks before 7.3.1 allows a user with Admin privileges to escalate their privileges by generating SSH pass
Kiteworks Secure Data Forms prior to version 9.2.1 contains a misconfiguration of security attributes that allows unprot
Kiteworks versions prior to 9.2.0 contain a DNS rebinding vulnerability that allows authenticated administrators to circ
Insecure Direct Object Reference (IDOR) in Kiteworks Secure Data Forms allows authenticated low-privileged users to modi
Insecure Direct Object Reference in Kiteworks Secure Data Forms (all versions prior to 9.3.0) allows any authenticated l
Kiteworks is a private data network (PDN). Rated medium severity (CVSS 6.3), this vulnerability is remotely exploitable,
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today