Medium severity · published Jun 1, 2026
CVE-2026-23638
Kiteworks Secure Data Forms is vulnerable to Authorization Bypass Through User-Controlled Key
6.5
CVSS
0.2%
EPSS
No
On KEV
Description
Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated attacker to tamper with the internal approval flow configurations of forms belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 8% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SD
Secure Data Forms · kiteworks
< 9.3.0 · source: vendor
KI
Kiteworks · Accellion
before 9.3.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-23638
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-23638
Vendor Advisory
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-8wmh-mg2h-hf46
More from Secure Data Forms
8.8
CVE-2026-24782
Kiteworks Secure Data Forms has a SQL Injection vulnerability
8.6
CVE-2026-102121
Kiteworks Secure Data Forms Exposure of Sensitive Information to an Unauthorized Actor
8.2
CVE-2026-24752
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
8.2
CVE-2026-24751
Kiteworks Secure Data Forms Vulnerable to Cross-site Scripting
7.5
CVE-2026-102091
Kiteworks Secure Data Forms server-side request forgery