What is CVE-2026-102121?

CVE-2026-102121 is a high-severity vulnerability in Kiteworks Secure Data Forms, classified under Information Disclosure. CVSS score: 8.6/10. Published 2026-09-30.

How severe is CVE-2026-102121?

High severity. CVSS v3 base score is 8.6 out of 10.

Auth bypass in Kiteworks Secure Data Forms

CVE-2026-102121

A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to anonymous visitors, but it returned more data than the form itself required. Anyone who knew the web address of a published form could potentially retrieve the form owner's Kiteworks account profile, including personal details, along with parts of the deployment's configuration settings; no passwords, authentication tokens, or multi-factor secrets were exposed.

Vulnerability class: Information Disclosure

Published 2026-09-30 · last modified 2026-10-01.

CVSS v3 metric

CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Kiteworks Secure Data Forms

Weakness classification (CWE)

References

9119a7d8-5eab-497f-8521-727c672e3725 (vendor-advisory)
9119a7d8-5eab-497f-8521-727c672e3725 (third-party-advisory)

Frequently asked questions

What is CVE-2026-102121?: CVE-2026-102121 is a high-severity vulnerability in Kiteworks Secure Data Forms, classified under Information Disclosure. CVSS score: 8.6/10. Published 2026-09-30.
How severe is CVE-2026-102121?: High severity. CVSS v3 base score is 8.6 out of 10.