Kiteworks Secure Data Forms contains an insecure direct object reference that allows an authenticated user to modify resources owned by other users because the system performs insufficient authorization checks on resource ownership. This flaw provides an attacker with a privilege escalation path, enabling unauthorized data tampering and potentially exposing confidential information. The weakness is classified as CWE‑639, representing an authorization bypass through user‑controlled data.

The affected product is Kiteworks Secure Data Forms. Versions prior to 9.3.0 are vulnerable; upgrading to version 9.3.0 or later remedies the issue.

The CVSS score of 6.5 categorizes the issue as medium severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that a widespread exploitation campaign has not been observed. Nonetheless, exploitation requires only an authenticated Kiteworks user, meaning any legitimate user, whether compromised or not, could potentially modify another user's data. Attackers would target the web interface or API endpoints that expose the underlying resource identifiers, substituting them to access or alter data belonging to other users.