# CVE-2026-102150: Kiteworks Secure Data Forms authentication bypass in Advanced Forms

Source: https://junglewise.ai/threats/cve-2026-102150-a-function-in-the-kiteworks-advanced-forms-component-was  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-30. Updated: 2026-09-30  
License: CC BY 4.0 with a link back

CVE-2026-102150 · Severity: high · CVSS 7.2 · Published 2026-09-30

Kiteworks Secure Data Forms, a secure file sharing and form management platform, contains an unauthenticated function in its Advanced Forms component that allows attackers to perform internal service operations without logging in. While the vulnerability does not expose user accounts, files, or form submissions, it could disrupt platform operations or provide a foothold for further attacks.

Technologies: [Kiteworks Secure Data Forms](https://junglewise.ai/threats/technologies/secure-data-forms). Vendors: [Kiteworks](https://junglewise.ai/threats/vendors/kiteworks).

## Quick answers

**Is CVE-2026-102150 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102150 being exploited in the wild.

**How severe is CVE-2026-102150?** High severity, with a CVSS score of 7.2, published 30 September 2026.

**Which products and versions are affected?** Kiteworks Secure Data Forms 9.3.0 to 9.5.0.

**Is there a fix for CVE-2026-102150?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-102150 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-102150?** Check whether you run Kiteworks Secure Data Forms at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Advanced Forms component in Kiteworks Secure Data Forms versions 9.3.0 through 9.5.0 fails to enforce authentication on a critical function (CWE-306), allowing network-based attackers with no privileges to invoke internal service operations. The vulnerability has a CVSS score of 7.2 reflecting scope change and low impact to confidentiality and integrity. A patch is available in version 9.5.1.

## Affected products

- Kiteworks Secure Data Forms 9.3.0 to 9.5.0

## Timeline

- 2026-09-30: disclosed

## References

- [https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vwvw-rp3m-rm37](https://github.com/kiteworks/security-advisories/security/advisories/GHSA-vwvw-rp3m-rm37)
- [https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json](https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json)

## Related threats

- [Kiteworks Secure Data Forms unauthenticated information disclosure in Advanced Forms](https://junglewise.ai/threats/cve-2026-102121-a-form-rendering-interface-in-the-advanced-forms-component-is)
- [Kiteworks Secure Data Forms SQL injection](https://junglewise.ai/threats/cve-2026-102109-a-sql-injection-vulnerability-existed-in-kiteworks-secure-data)
- [Kiteworks Secure Data Forms SSRF](https://junglewise.ai/threats/cve-2026-102091-kiteworks-secure-data-forms-before-version-9-5-0-is-vulnerable)
- [Kiteworks Secure Data Forms SQL injection](https://junglewise.ai/threats/cve-2026-24782-kiteworks-secure-data-forms-sql-injection)
- [Kiteworks Secure Data Forms IDOR in metadata access](https://junglewise.ai/threats/cve-2026-24761-kiteworks-secure-data-forms-idor-in-metadata-access)