CVE-2026-102121
Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor
CVSS Score
8.6
EPSS Score
0.0%
EPSS Percentile
0th
A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve the form owner's Kiteworks account profile, including personal details, along with parts of the deployment's configuration settings; no passwords, authentication tokens, or multi-factor secrets were exposed.
| CWE | CWE-200 CWE-306 |
| Vendor | kiteworks |
| Product | secure data forms |
| Published | Sep 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for kiteworks secure data forms
Be the first to know when new high vulnerabilities affecting kiteworks secure data forms are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
Kiteworks / Secure Data Forms
0 < 9.5.1