CVE-2026-24756: Accellion Kiteworks Auth Bypass Flaw

CVE-2026-24756 Overview

CVE-2026-24756 is an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms. The flaw affects all Kiteworks versions prior to 9.3.0. Authenticated users can modify resources belonging to other users because the application performs insufficient authorization checks on resource ownership. Kiteworks is a private data network (PDN) used by organizations to share sensitive files and forms. The vulnerability is classified under CWE-639: Authorization Bypass Through User-Controlled Key. Accellion has released version 9.3.0 to address the issue.

Critical Impact
An authenticated attacker can tamper with form resources owned by other tenants, compromising data integrity within the Kiteworks Secure Data Forms feature.

Affected Products

Accellion Kiteworks versions prior to 9.3.0
Kiteworks Secure Data Forms component
All deployments exposing the affected Forms endpoints to authenticated users

Discovery Timeline

2026-06-01 - CVE-2026-24756 published to the National Vulnerability Database
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-24756

Vulnerability Analysis

The vulnerability resides in the authorization logic governing Kiteworks Secure Data Forms. When an authenticated user issues a request to modify a form resource, the application identifies the target resource using a client-supplied identifier. The server validates that the requester is authenticated but does not verify that the supplied identifier belongs to a resource owned by that user. As a result, any authenticated user can substitute another user's resource identifier and modify objects outside their authorization scope. The impact is limited to integrity. Confidentiality and availability are not directly affected, according to the published CVSS metrics.

Root Cause

The root cause is a missing object-level authorization check, mapped to CWE-639. The Forms backend trusts user-controlled identifiers without cross-referencing them against the authenticated session's ownership records. This is a classic Broken Object Level Authorization (BOLA) pattern documented in the OWASP API Security Top 10.

Attack Vector

Exploitation requires network access to the Kiteworks application and valid low-privileged credentials. No user interaction is required. An attacker enumerates or guesses resource identifiers for forms belonging to other users, then issues authenticated modification requests substituting the target identifier. The server applies the change without verifying ownership. Refer to the Kiteworks GitHub Security Advisory GHSA-jgvj-mf78-rxx8 for vendor technical details.

Detection Methods for CVE-2026-24756

Indicators of Compromise

Unexpected modifications to Secure Data Forms resources where the modifying user differs from the resource owner recorded in audit logs.
Authenticated HTTP requests to Forms API endpoints containing resource identifiers that do not appear in the user's prior session history.
Spikes in sequential or enumerated resource identifier values within Forms endpoint access logs.

Detection Strategies

Review application audit logs for resource modification events and correlate the actor identity with the recorded resource owner.
Implement server-side logging that records both the authenticated subject and the owner of every accessed Forms object for later comparison.
Hunt for repeated 200-status modification requests from a single account against many distinct resource identifiers within a short timeframe.

Monitoring Recommendations

Forward Kiteworks application and audit logs to a centralized SIEM for correlation across users and tenants.
Alert on anomalous cross-user resource modification patterns within the Forms module.
Track baseline form interaction rates per user and flag deviations that suggest enumeration of foreign resource identifiers.

How to Mitigate CVE-2026-24756

Immediate Actions Required

Upgrade Kiteworks to version 9.3.0 or later as directed by the vendor advisory.
Audit recent Secure Data Forms modifications to identify any unauthorized changes made prior to patching.
Review user account inventory and disable inactive or unnecessary accounts to reduce the authenticated attacker surface.

Patch Information

Accellion has released Kiteworks 9.3.0, which adds the missing authorization checks on Secure Data Forms resources. Administrators should consult the Kiteworks Security Advisory GHSA-jgvj-mf78-rxx8 for upgrade guidance and verify the running version after deployment.

Workarounds

No vendor-supplied workaround is documented. Upgrading to 9.3.0 is the supported remediation.
As an interim measure, restrict access to the Secure Data Forms feature to a minimal set of trusted users until the patch can be applied.
Increase audit log retention and review frequency for Forms activity during the remediation window.

bash

# Verify the installed Kiteworks version meets or exceeds the patched release
# Replace <kiteworks-host> with the appliance hostname
curl -sk https://<kiteworks-host>/rest/v20/admin/version \
  -H "Authorization: Bearer <admin-token>"

# Expected: version field reports 9.3.0 or later