CVE-2026-24755: Accellion Kiteworks Auth Bypass Vulnerability

CVE-2026-24755 Overview

CVE-2026-24755 is an Insecure Direct Object Reference (IDOR) vulnerability [CWE-639] in Kiteworks Secure Data Forms. Kiteworks is a private data network (PDN) used for secure file sharing and managed file transfer. The flaw affects all releases prior to version 9.3.0. An authenticated user can modify permissions on resources belonging to other users because the application performs insufficient authorization checks on resource ownership. Accellion patched the issue in Kiteworks 9.3.0.

Critical Impact
An authenticated attacker can alter permission settings on resources owned by other tenants of the same Kiteworks instance, leading to unauthorized access and integrity loss on shared data.

Affected Products

Accellion Kiteworks versions prior to 9.3.0
Kiteworks Secure Data Forms component
All Kiteworks deployments exposing the affected API endpoints

Discovery Timeline

2026-06-01 - CVE-2026-24755 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-24755

Vulnerability Analysis

The vulnerability resides in the Secure Data Forms feature of Kiteworks. The application exposes endpoints that accept a resource identifier in the request but fail to verify that the requesting user owns or has rights to that resource. As a result, any authenticated user can supply another user's resource ID and modify the permissions attached to it. The defect is classified under CWE-639: Authorization Bypass Through User-Controlled Key. Exploitation requires low privileges and no user interaction, and the attack is delivered over the network. Impact is limited to confidentiality and integrity of affected resources, with no direct effect on availability.

Root Cause

The Secure Data Forms permission management logic trusts client-supplied object references without enforcing an ownership check. The server-side authorization layer validates that the caller is authenticated but does not validate that the caller is the resource owner or has been delegated rights on that resource. This omission allows horizontal privilege escalation across tenants and user accounts within the same Kiteworks instance.

Attack Vector

An authenticated attacker enumerates or guesses resource identifiers belonging to other users. The attacker then issues a permission-modification request through the Secure Data Forms API, substituting the target identifier. Because the backend does not enforce ownership checks, the request succeeds and the attacker gains the ability to grant, revoke, or alter access on the victim's resource. The vulnerability does not require any social engineering or victim interaction.

No public proof-of-concept or exploit code is currently available for CVE-2026-24755. Refer to the Kiteworks GitHub Security Advisory GHSA-f8rf-7jq6-gch9 for vendor-supplied details.

Detection Methods for CVE-2026-24755

Indicators of Compromise

Unexpected permission changes on Secure Data Forms resources reported by end users.
Audit log entries showing one user account modifying permissions on resources owned by another account.
HTTP requests to Secure Data Forms permission endpoints containing resource IDs that do not match the authenticated session owner.

Detection Strategies

Correlate Kiteworks application audit logs with user-to-resource ownership mappings to surface cross-account permission edits.
Alert on bursts of permission-modification API calls from a single authenticated session targeting many distinct resource IDs.
Review Secure Data Forms change history for permission grants issued by accounts that have no prior relationship with the target resource.

Monitoring Recommendations

Forward Kiteworks audit logs to a centralized logging or SIEM platform and retain them for incident review.
Establish a baseline for normal permission-change volume per user and alert on statistical deviations.
Monitor authentication events alongside permission-modification activity to identify compromised or abusive accounts.

How to Mitigate CVE-2026-24755

Immediate Actions Required

Upgrade Kiteworks to version 9.3.0 or later, which contains the official patch.
Inventory all Kiteworks deployments and confirm the running build version matches the patched release.
Audit Secure Data Forms permission changes made before the upgrade to identify and reverse unauthorized modifications.

Patch Information

Accellion released a fix in Kiteworks 9.3.0. The patch introduces server-side ownership validation in the Secure Data Forms permission workflow. Administrators should review the Kiteworks GitHub Security Advisory GHSA-f8rf-7jq6-gch9 for upgrade procedures and verification steps.

Workarounds

No vendor-supplied workaround exists; upgrading to 9.3.0 is the only supported remediation.
Restrict Secure Data Forms feature usage to a limited set of trusted users until the patch is applied.
Increase logging verbosity on Kiteworks permission-management endpoints to support post-incident review.

bash

# Verify the running Kiteworks version after upgrade
curl -sk https://<kiteworks-host>/rest/v8/info | jq '.version'
# Expected output: "9.3.0" or higher