A vulnerable form‑rendering interface in Kiteworks Secure Data Forms allows unauthorized users to view published forms without authentication. Because this endpoint returns additional attributes beyond the form itself, anyone who knows the URL can retrieve the owner’s account profile, personal information, and parts of the deployment configuration. While no passwords or authentication tokens are exposed, the leakage of personal and configuration data poses a privacy and operational risk.

This issue impacts the Kiteworks Advanced Forms component, specifically the Secure Data Forms product. The advisory does not list affected product versions, so a review of all deployments is required. Administrators should verify which systems currently expose the vulnerable endpoint and assess whether the form data may contain sensitive information.

The CVSS score of 8.6 indicates high severity. The EPSS score is not available, so the likelihood of exploitation cannot be quantified from the current data, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated HTTP/HTTPS request to the form-rendering URL; an attacker with knowledge of the URL can obtain unintended data. The vulnerability originates from missing authentication and improper information exposure controls, matching CWE-200 and CWE-306.