Kiteworks Secure Data Forms contains an insecure direct object reference that lets an authenticated user modify or delete data owned by other users. The vulnerability is a direct result of missing ownership checks on objects such as form definitions, submission data, or associated file uploads. If exploited, a legitimate user could gain full control over another user’s confidential records, leading to confidentiality and integrity violations. The weakness is classified as CWE-639.

The issue affects all installations of kiteworks:Secure Data Forms before version 9.3.0. Users with normal authentication rights are able to engage the IDOR. No other products or versions are listed as affected.

The CVSS base score of 4.3 places the vulnerability in the low severity range. The EPSS score is not available, and it is not listed in CISA’s KEV catalog, indicating a low likelihood of widespread exploitation at present. The likely attack vector requires a valid user account – an authenticated attacker can supply arbitrary resource identifiers to target another user's data. Until mitigation, any organization running an affected version must monitor user activity for unauthorized modifications and promptly upgrade.