Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor
A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve the form owner's Kiteworks account profile, including personal details, along with parts of the deployment's configuration settings; no passwords, authentication tokens, or multi-factor secrets were exposed.
CVE-2026-102121
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-102121
Secure Data Forms
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Kiteworks",
"product": "Secure Data Forms",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "9.5.1",
"versionType": "custom"
},
{
"status": "unaffected",
"version": "9.5.1"
}
],
"defaultStatus": "unknown"
}
]- Related CVEs
- CVE-2026-102121
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #5154 · Revision 1
- Added to Heist Feed
- Publisher date