CVE-2026-23638

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated attacker to tamper with the internal approval flow configurations of forms belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-8wmh-mg2h-hf46	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-06-01 19:16

Updated : 2026-07-22 07:10

NVD link : CVE-2026-23638

Mitre link : CVE-2026-23638

CVE.ORG link : CVE-2026-23638

JSON object : View

Products Affected

accellion

kiteworks

CWE

CWE-639

Authorization Bypass Through User-Controlled Key

{"id": "CVE-2026-23638", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23638", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-01T18:59:31.552498Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "kiteworks", "product": "Secure Data Forms", "versions": [{"status": "affected", "version": "< 9.3.0"}]}]}], "published": "2026-06-01T19:16:22.140", "references": [{"url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-8wmh-mg2h-hf46", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-639"}]}], "descriptions": [{"lang": "en", "value": "Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated attacker to tamper with the internal approval flow configurations of forms belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch."}, {"lang": "es", "value": "Kiteworks es una red de datos privada (PDN). Antes de la versi\u00f3n 9.3.0, una vulnerabilidad de referencia directa insegura a objetos (IDOR) en los formularios de datos seguros de Kiteworks permite a un atacante autenticado manipular las configuraciones internas del flujo de aprobaci\u00f3n de formularios pertenecientes a otros usuarios debido a comprobaciones de autorizaci\u00f3n insuficientes sobre la propiedad de los recursos. Actualice Kiteworks a la versi\u00f3n 9.3.0 o posterior para recibir un parche."}], "lastModified": "2026-07-22T07:10:00.107", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:accellion:kiteworks:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3553DA81-4AB9-47AA-8366-77E3BB3192D4", "versionEndExcluding": "9.3.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}