Kiteworks Secure Data Forms contains an Insecure Direct Object Reference flaw that permits an authenticated user to read metadata of resources owned by other users because ownership checks are missing. This does not grant execution or modification rights but exposes sensitive information about other users, potentially revealing project details, user identities, or other confidential data. The weakness is classified as CWE‑639: Authorization Bypass Through User‑Controlled Key.

All installations of Kiteworks Secure Data Forms running versions earlier than 9.3.0 are affected, regardless of additional configuration. The issue is isolated to the Secure Data Forms module and does not extend to other Kiteworks components.

The CVSS score of 3.7 indicates a low‑to‑moderate severity; the EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have valid user credentials within the system, so access is limited to authenticated users. Once authenticated, the attacker can inspect confidential metadata, which may lead to privacy violations or aid further attacks, but does not provide direct control over the system.