CVE-2026-23638 is an authorization bypass vulnerability classified under CWE-639 affecting Kiteworks Secure Data Forms before version 9.3.0. The flaw arises from insufficient authorization validation on resource ownership, enabling authenticated users to tamper with internal approval flow configurations of forms belonging to other users. This is an insecure direct object reference (IDOR) vulnerability that compromises the integrity of form approval workflows. The vulnerability has a CVSS v3.1 base score of 6.5 (medium severity), with network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. Upgrading to version 9.3.0 or later mitigates this vulnerability.

The vulnerability allows authenticated attackers to modify approval flow configurations of other users' forms, impacting the integrity of the approval process. There is no impact on confidentiality or availability. No known exploits are reported in the wild at this time.

Upgrade Kiteworks Secure Data Forms to version 9.3.0 or later to apply the official patch that fixes this authorization bypass vulnerability. Since the vendor advisory explicitly states upgrading to 9.3.0 or later addresses the issue, no additional mitigations are required.