Secure Data Forms EUVD-2026-90298

Exploitation requires only that a form has been published in the Kiteworks Advanced/Secure Data Forms component and that the attacker knows (or enumerates) the form's public web address - the form-rendering interface is intentionally reachable by anonymous visitors, so no authentication, credentials, or user interaction are needed against a default deployment serving published forms. The limiting factors are: the attacker must know a valid published-form URL (not a fully open directory listing), and impact is capped to information disclosure of the form owner's account profile plus partial deployment configuration - no passwords, authentication tokens, or MFA secrets are returned, and there is no integrity or availability effect.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N = 8.6) is internally consistent with the description: the affected form-rendering interface is explicitly reachable without authentication (PR:N, matching 'reachable without authentication'), needs no user interaction, and the scope change (S:C) is justified because an anonymous form-viewer authority gains data belonging to a different authority - the form owner's account profile and deployment configuration. Impact is confidentiality-only (C:H, I:N, A:N), and the description meaningfully caps that impact by stating no passwords, authentication tokens, or MFA secrets were exposed, so this is disclosure of PII and config metadata rather than a credential leak that would enable direct account takeover. There is no EPSS score, no CISA KEV listing, and no public PoC in the provided intelligence, so real-world exploitation signal is absent - this is a vendor/CISA-coordinated disclosure (reported by cisa-cg, GHSA advisory) with no evidence of active exploitation. The 8.6 is genuinely elevated by the unauthenticated network vector plus scope change rather than by impact breadth; treat it as a real but bounded priority: easy to exploit if a published form URL is known, but limited to information disclosure with no integrity/availability effect and no secret exposure.

An attacker who discovers or guesses the public web address of a published Kiteworks Advanced/Secure Data Form requests it as an anonymous visitor and observes that the response embeds far more than the form fields - the form owner's Kiteworks account profile and portions of deployment configuration. By harvesting these URLs across an organization, the attacker builds a profile of staff personal details and infrastructure settings for phishing or follow-on targeting. No authentication is required and no public exploit code is identified at time of analysis; the 'exploit' is simply reading the oversized response.