CVE-2026-23638
Kiteworks IDOR in Secure Data Forms
Publication date: 2026-06-01
Last updated on: 2026-06-01
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| kiteworks | kiteworks_secure_data_forms | to 9.3.0 (exc) |
| kiteworks | kiteworks | to 9.3.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-23638 is an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms versions prior to 9.3.0. It allows an authenticated attacker to manipulate the internal approval flow configurations of forms that belong to other users. This happens because the system does not properly check whether the user owns the resource they are trying to modify, leading to insufficient authorization checks.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker with valid credentials to tamper with the approval flow configurations of other users' forms. This can compromise the integrity of the data approval process, potentially leading to unauthorized changes or approvals within the system. Although it does not affect confidentiality or availability, the integrity impact is high.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade Kiteworks Secure Data Forms to version 9.3.0 or later.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows an authenticated attacker to tamper with internal approval flow configurations of forms belonging to other users due to insufficient authorization checks. This can lead to unauthorized modification of data approval processes, potentially impacting data integrity.
Such unauthorized access and modification could affect compliance with standards and regulations like GDPR and HIPAA, which require strict controls over data access and integrity to protect personal and sensitive information.
However, the provided information does not explicitly state the direct impact on compliance with these regulations.