CVE-2026-24753: Accellion Kiteworks Auth Bypass Flaw

CVE-2026-24753 Overview

CVE-2026-24753 is an Insecure Direct Object Reference (IDOR) vulnerability affecting Accellion Kiteworks, a private data network (PDN) platform. The flaw resides in the Kiteworks Secure Data Forms component and stems from insufficient authorization checks on resource ownership. An authenticated user can modify resources belonging to other users by manipulating object identifiers in requests. The vulnerability affects all Kiteworks versions prior to 9.3.0 and is tracked under [CWE-639]: Authorization Bypass Through User-Controlled Key.

Critical Impact
Authenticated attackers can tamper with form resources owned by other users, compromising data integrity across tenants on the platform.

Affected Products

Accellion Kiteworks versions prior to 9.3.0
Kiteworks Secure Data Forms component
All deployments of Kiteworks PDN below the patched release

Discovery Timeline

2026-06-01 - CVE-2026-24753 published to the National Vulnerability Database
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-24753

Vulnerability Analysis

The vulnerability is classified as an Insecure Direct Object Reference within Kiteworks Secure Data Forms. The application exposes object identifiers in requests that reference form resources but fails to verify whether the requesting user owns the referenced object. An authenticated user with low privileges can substitute another user's resource identifier and issue modification requests that the backend accepts.

The CVSS vector indicates network-based exploitation with low attack complexity and no user interaction required. The impact is limited to integrity, with no direct confidentiality or availability consequences reported by the vendor. Successful exploitation allows tampering with form data that belongs to other tenants or users within the same Kiteworks instance.

Root Cause

The root cause is missing or insufficient authorization logic on resource ownership. The server-side handlers for Secure Data Forms validate authentication but do not enforce that the authenticated principal owns or has rights to the referenced object. This pattern aligns with [CWE-639], where access control decisions rely on user-controlled keys rather than session-bound ownership checks.

Attack Vector

An attacker authenticates to the Kiteworks instance with any valid user account. The attacker then issues an HTTP request to the Secure Data Forms endpoint, substituting the target object identifier in the request body or URL parameter. The server processes the modification without confirming that the object belongs to the requesting user. No verified proof-of-concept exploit is publicly available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

The vulnerability manifests in the resource handler for Secure Data Forms within the Kiteworks application. See the Kiteworks GitHub Security Advisory for vendor technical details.

Detection Methods for CVE-2026-24753

Indicators of Compromise

Unexpected modifications to Secure Data Forms entries that the owning user did not perform
Audit log entries showing form resource updates initiated by user accounts that do not own the referenced object
Sequential or enumerated object identifier patterns in HTTP request logs targeting form endpoints

Detection Strategies

Review Kiteworks application audit logs for resource modification events and cross-reference the acting user against the form owner
Implement web application firewall rules to flag requests where the object identifier does not correlate with the session user
Hunt for anomalous request patterns involving high-volume access to incrementing resource identifiers

Monitoring Recommendations

Forward Kiteworks audit logs to a centralized SIEM for correlation against user identity and ownership metadata
Establish baseline activity for Secure Data Forms usage per user and alert on deviations
Monitor authentication logs for accounts exhibiting unusual API access patterns after the patch is deployed

How to Mitigate CVE-2026-24753

Immediate Actions Required

Upgrade Kiteworks to version 9.3.0 or later as the primary remediation
Inventory all Kiteworks deployments and confirm the running version against the patched release
Audit Secure Data Forms resources for unauthorized modifications dating back to deployment

Patch Information

Accellion has released Kiteworks version 9.3.0, which adds the missing authorization checks on resource ownership within Secure Data Forms. Administrators should follow the upgrade procedure documented in the Kiteworks GitHub Security Advisory GHSA-qmv7-28g4-hx9x. No vendor-supplied workaround is documented; upgrading is the supported remediation path.

Workarounds

Restrict access to Secure Data Forms to trusted user populations until the patch is applied
Increase audit log retention and review frequency on form modification events
Enforce least-privilege role assignments to limit the pool of authenticated users who can reach the vulnerable endpoint

bash

# Verify Kiteworks version is patched
# Target version: 9.3.0 or later
curl -sk https://<kiteworks-host>/rest/v17/system/version \
  -H "Authorization: Bearer <admin-token>"