Vulnerability in Kiteworks Secure Data Forms

[ Description ]Official description

A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve the form owner's Kiteworks account profile, including personal details, along with parts of the deployment's configuration settings; no passwords, authentication tokens, or multi-factor secrets were exposed.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• NCSC-NL8 Oct 2026NCSC-2026-0408

  Vulnerabilities fixed in Kiteworks Translated from Dutch

  Probability/damage M/HCVE-2026-102089CVE-2026-102090CVE-2026-102091+58 more CVEs
• BSI CERT-Bund30 Sep 2026WID-SEC-2026-3695

  Kiteworks: Multiple vulnerabilities Translated from German

  CVE-2026-102100CVE-2026-102144CVE-2026-102117+58 more CVEs

[ References ]References

• github.com/kiteworks/security-advisories/security/advisories/GHSA-hf68-855j-745cVendor Advisory
• raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.jsonBroken Link