Kiteworks Secure Data Forms: Exposure of sensitive information to unauthenticated users
Summary
A form-rendering interface in the Advanced Forms component of Kiteworks Secure Data Forms is reachable without authentication and returns more data than the form requires. An attacker who knows the web address of a published form can retrieve the form owner's account profile, including personal details, and parts of the deployment configuration. Passwords, authentication tokens and multi-factor secrets are not exposed according to the vendor.
Affected
- Kiteworks Secure Data Forms (Advanced Forms) versions before 9.5.1
- Earlier versions than the ones listed are not confirmed; the lower bound is unknown.
Fixed in
- Upgrade to Kiteworks Secure Data Forms 9.5.1 or later.
Workaround
- Audit all published forms for personal data or configuration details and remove or redact anything unintended.
- No vendor-published workaround that disables the endpoint is known.
Exploitation
- Kiteworks reported no indication of exploitation or compromise related to this issue.
- CISA data is reported as recording exploitation as "none"; not directly verified.
- No public proof of concept found.
Our recommendation
- Check whether Advanced Forms or Secure Data Forms is installed and whether any forms are published.
- Confirm the installed version and upgrade to 9.5.1 or later. Kiteworks-hosted environments were restored by the vendor; self-managed deployments must verify their own version.
- Review published forms for personal data or configuration exposure and remove anything unintended.
- Review web server or application logs for anonymous access to form URLs.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-hf68-855j-745c github.com
- CISA CSAF VA-26-274-01 raw.githubusercontent.com
- OpenCVE CVE-2026-102121 app.opencve.io
- Kiteworks precautionary shutdown advisory www.kiteworks.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:34.
Original description (NVD)
A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve the form owner's Kiteworks account profile, including personal details, along with parts of the deployment's configuration settings; no passwords, authentication tokens, or multi-factor secrets were exposed.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.