An Insecure Direct Object Reference flaw exists in Kiteworks Secure Data Forms that allows an authenticated user to change the permissions of data resources owned by others. The weakness, identified as CWE-639, permits the modification of access controls without adequate ownership checks, potentially enabling covert data sharing or loss of confidentiality. The vulnerability does not expose remote code execution or data exfiltration directly, but it does compromise the integrity and confidentiality of protected files within the private data network.

Kiteworks Secure Data Forms versions prior to 9.3.0 are affected. The flaw is present in all releases of the product before the 9.3.0 update, regardless of the deployment environment or user role, as long as the user is authenticated. No specific hardware or operating system is required for exploitation.

The CVSS score of 5.4 indicates moderate severity. At the time of this assessment no EPSS data is available, and the issue is not listed in the CISA KEV catalog, implying that it is not known to be actively exploited in the wild. The attack vector is inferred to be Authenticated. An attacker who has legitimate credentials can target any owned resource and alter its permissions, subject to network access to the Kiteworks instance.