CVE-2026-102121

Received Received - Intake

Information Disclosure in Kiteworks Advanced Forms

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve the form owner's Kiteworks account profile, including personal details, along with parts of the deployment's configuration settings; no passwords, authentication tokens, or multi-factor secrets were exposed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102121

EUVD

EUVD-2026-90298

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability involves an unauthenticated form-rendering interface in the Advanced Forms component that exposes more data than intended. Attackers can access published forms via their web address and retrieve the form owner's Kiteworks account profile, including personal details and parts of deployment configuration settings. No passwords, authentication tokens, or multi-factor secrets were exposed.

Impact Analysis

This vulnerability could allow unauthorized individuals to access sensitive personal information of form owners, including their account details and parts of system configurations. This may lead to privacy breaches, identity theft, or unauthorized access to system settings.

Compliance Impact

This vulnerability likely violates data protection regulations such as GDPR and HIPAA by exposing personal and sensitive information without authorization. Organizations may face legal penalties, fines, and reputational damage due to non-compliance with privacy requirements.

Mitigation Strategies

Restrict access to the form-rendering interface to authenticated users only. Review and update server configurations to ensure sensitive data is not exposed through published forms. Monitor network traffic for unauthorized access attempts to form endpoints.

Hi! I’m here to help you understand CVE-2026-102121. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70