CVE-2026-24761 Overview
CVE-2026-24761 is an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms. Kiteworks is a private data network (PDN) used by enterprises to exchange sensitive content. The flaw exists in versions prior to 9.3.0 and stems from insufficient authorization checks on resource ownership. An authenticated user can access metadata of resources belonging to other users by referencing their identifiers directly. The issue is tracked under CWE-639 and was disclosed through the Kiteworks GitHub Security Advisory GHSA-6489-ffwq-96hh.
Critical Impact
Authenticated users can enumerate and read metadata of Secure Data Form resources owned by other tenants or users, exposing confidential business information.
Affected Products
- Accellion Kiteworks versions prior to 9.3.0
- Kiteworks Secure Data Forms component
- All Kiteworks deployments using affected releases
Discovery Timeline
- 2026-06-01 - CVE-2026-24761 published to NVD
- 2026-06-03 - Last updated in NVD database
Technical Details for CVE-2026-24761
Vulnerability Analysis
The vulnerability affects the Secure Data Forms feature in Kiteworks. The application exposes resource identifiers in API requests but does not verify that the requesting user owns or has permission to access the referenced resource. This is a classic Insecure Direct Object Reference flaw under CWE-639.
Exploitation requires only a low-privileged authenticated session. The attacker substitutes another user's resource identifier in a request and receives metadata in the response. The scope is limited to metadata disclosure, with no integrity or availability impact, and the attack is exploitable over the network without user interaction.
The EPSS probability stands at 0.029%, reflecting low predicted exploitation activity at this time.
Root Cause
The Kiteworks application performs authentication but omits an ownership check at the authorization layer when serving Secure Data Form resources. The server trusts the resource identifier supplied by the client and returns metadata without confirming that the identifier maps to a resource the caller is allowed to view.
Attack Vector
An authenticated attacker iterates or guesses resource identifiers and issues requests through the standard Kiteworks Secure Data Forms API. Because identifiers are predictable or enumerable, an attacker can systematically harvest metadata across tenants. Refer to the Kiteworks GitHub Security Advisory for technical specifics. No verified public exploit code is currently available.
Detection Methods for CVE-2026-24761
Indicators of Compromise
- Unusual volume of sequential or enumerated requests against Secure Data Forms endpoints from a single authenticated session.
- Authenticated API responses returning metadata for resource identifiers that do not correspond to the requesting user's owned objects.
- Spikes in 200 OK responses to resource lookup endpoints from accounts with no legitimate need to query them.
Detection Strategies
- Review Kiteworks application logs for high-frequency access to Secure Data Form resource endpoints by individual user accounts.
- Correlate user identity with the owner field of accessed resources to surface cross-user reads.
- Establish a baseline of normal form-access patterns per user role and alert on deviations.
Monitoring Recommendations
- Forward Kiteworks audit logs to a centralized SIEM and retain them for forensic review.
- Monitor authentication events alongside resource access events to attribute IDOR probing to specific accounts.
- Track outbound data volume per authenticated session to detect bulk metadata extraction.
How to Mitigate CVE-2026-24761
Immediate Actions Required
- Upgrade Kiteworks to version 9.3.0 or later as directed by the vendor advisory.
- Audit recent Secure Data Form access logs for cross-user metadata reads.
- Rotate or review API tokens for accounts that exhibit anomalous resource access patterns.
Patch Information
Kiteworks has released version 9.3.0, which adds the missing ownership validation on Secure Data Form resources. Administrators should follow the upgrade procedure documented in the Kiteworks GitHub Security Advisory GHSA-6489-ffwq-96hh.
Workarounds
- No vendor-supplied workaround is documented; upgrading to 9.3.0 is the required remediation.
- Restrict Secure Data Forms access to a minimal set of trusted users until patching is complete.
- Enable enhanced logging on form-related endpoints to detect exploitation attempts during the patch window.
# Verify the installed Kiteworks version meets the patched release
kiteworks-cli version
# Expected output: 9.3.0 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
