PT-2026-45654 · Kiteworks · Secure Data Forms

Published 2026-06-01 · Updated 2026-06-01 · CVE-2026-24782

NVD

CVSS v3.1

7.6

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L

Kiteworks is a private data network (PDN). Prior to version 9.3.0,ultiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms could be exploited by an authenticated attacker with the FormBuilder role to retrieve information on or modify other users' form definitions and some global configuration parameters. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-24782

Affected Products

Secure Data Forms

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2026-24782 · Security Note
• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-849r-gm3r-4v5c · Note