The vulnerability is an Insecure Direct Object Reference that lets an authenticated attacker modify approval flow configurations of forms owned by other users. By tampering with these settings an attacker can alter the approval process, potentially bypassing required approvals or escalating privileges. This raises integrity and potentially confidentiality if approvals control access to sensitive data, and is classified as CWE‑639.

The affected component is Kiteworks Secure Data Forms. Versions before 9.3.0 are vulnerable. The product is part of the Kiteworks private data network solution, and any instance running a pre‑9.3.0 build of Secure Data Forms faces this issue.

The CVSS score of 6.5 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in CISA's KEV catalog. The exploit would require an authenticated user, suggesting the attack vector is an authenticated session. Once authenticated, the attacker can change configuration of other users' forms. Although the overall risk is moderate, organizations should address it promptly since the attacker can manipulate approval workflows that may control access to confidential data.