CVE-2026-23638

Vulnerability

An Insecure Direct Object Reference (IDOR) vulnerability exists in Kiteworks Secure Data Forms prior to version 9.3.0. This flaw stems from insufficient authorization checks on resource ownership, allowing an authenticated attacker to tamper with the internal approval flow configurations of forms belonging to other users [1].

Exploitation

An authenticated attacker can exploit this vulnerability by manipulating requests to target form configurations not owned by them. This requires the attacker to have valid user credentials and network access to the Kiteworks instance. The exploit involves bypassing authorization checks that fail to verify resource ownership before allowing modifications [1].

Impact

Successful exploitation allows an attacker to tamper with the internal approval flow configurations of forms belonging to other users. This could lead to unauthorized changes in data handling processes, potentially disrupting workflows or granting unintended access to sensitive information, depending on the nature of the altered approval flows [1].

Mitigation

Kiteworks has released version 9.3.0, which includes a patch for this vulnerability. Users are advised to upgrade to version 9.3.0 or later to remediate the issue [1].