CVE-2026-23638

Multiple SQL Injection vulnerabilities in Kiteworks Secure Data Forms. An authenticated attacker with the FormBuilder role can read and modify other users' form definitions and global configuration parameters.

In Kiteworks prior to version 9.3.0, an IDOR vulnerability was found. An authenticated user can access metadata of other users' resources due to insufficient authorization checks.

An Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms prior to version 9.3.0 allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks.

Kiteworks prior to version 9.3.0 has an IDOR vulnerability in Secure Data Forms, allowing an authenticated user to modify permissions on resources belonging to other users due to insufficient authorization checks.

Kiteworks prior to version 9.3.0 has a stored XSS vulnerability in Secure Data Forms, allowing an authenticated attacker to execute arbitrary JavaScript code in other users' sessions.

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated user to modify resources belonging to other users due to insufficient authorization checks on resource ownership.

Reflected XSS vulnerability in Kiteworks Secure Data Forms prior to version 9.3.0. An external attacker can trick a user into executing arbitrary JavaScript code via a crafted link.

Kiteworks prior to version 9.3.0 has a reflected XSS vulnerability in Secure Data Forms, allowing an external attacker to trick a user into executing arbitrary JavaScript code. Fixed in version 9.3.0.