The vulnerability is a classic SQL injection flaw in Kiteworks Secure Data Forms that allows an authenticated user with the FormBuilder role to craft queries that read or modify other users' form definitions and certain global configuration settings. Attackers can use this entry point to obtain sensitive data stored in the database or to change settings that affect the entire application, potentially impacting multiple users.

The affected product is Kiteworks Secure Data Forms. Any installation of the software older than version 9.3.0 is vulnerable. Versions 9.3.0 and later include the remediation.

The CVSS score of 7.6 indicates high severity, while the EPSS score is not reported. The vulnerability is not currently listed in the CISA KEV catalog. Because it requires authentication with a privileged role, the attack vector is expected to be internal or from a compromised account; an attacker who has legitimate FormBuilder credentials can exploit the flaw without needing network-level access.