CVE-2026-23638: Accellion Kiteworks Auth Bypass Flaw

CVE-2026-23638 Overview

CVE-2026-23638 is an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms. Kiteworks is a private data network (PDN) used for secure file transfer and data exchange. The flaw allows an authenticated attacker to tamper with the internal approval flow configurations of forms owned by other users. The issue stems from insufficient authorization checks on resource ownership and is tracked under [CWE-639]. All versions prior to 9.3.0 are affected, and the vendor has released a patched build in version 9.3.0.

Critical Impact
An authenticated user can modify approval workflow settings on forms belonging to other tenants or users, undermining integrity of regulated business processes.

Affected Products

Accellion Kiteworks versions prior to 9.3.0
Kiteworks Secure Data Forms component
All deployments using approval flow configurations in shared form environments

Discovery Timeline

2026-06-01 - CVE-2026-23638 published to NVD
2026-06-03 - Last updated in NVD database

Technical Details for CVE-2026-23638

Vulnerability Analysis

The vulnerability exists in the Secure Data Forms component of Kiteworks. Secure Data Forms supports configurable approval flows that gate submitted form data. The application exposes endpoints that accept form and configuration identifiers but fails to verify that the requesting user owns or has rights to the referenced resource. An authenticated attacker can supply identifiers for forms owned by other users and modify the approval flow configuration. This directly impacts integrity of regulated workflows, although confidentiality of stored data and service availability are not affected. Exploitation requires only low-privilege authenticated access over the network with no user interaction.

Root Cause

The root cause is missing server-side authorization on resource ownership. The endpoint trusts client-supplied form identifiers without confirming the authenticated principal owns the referenced form. This is a classic IDOR pattern mapped to [CWE-639] (Authorization Bypass Through User-Controlled Key).

Attack Vector

The attacker authenticates to the Kiteworks instance with any valid account. The attacker then issues API requests to the approval flow configuration endpoint, substituting the identifier of a form owned by another user. Because ownership is not enforced, the backend applies the requested change. The attacker can alter approvers, bypass conditions, or otherwise reroute the approval logic of victim-owned forms.

No public proof-of-concept is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Kiteworks GitHub Security Advisory GHSA-8wmh-mg2h-hf46 for vendor technical details.

Detection Methods for CVE-2026-23638

Indicators of Compromise

Unexpected modifications to approval flow configurations on Secure Data Forms not initiated by the form owner
API requests to form configuration endpoints where the authenticated user identifier does not match the form owner identifier
Audit log entries showing approval flow edits by users with no historical association to the affected form

Detection Strategies

Review Kiteworks application audit logs for form configuration or approval flow change events and correlate the actor against the form owner
Hunt for sequential enumeration of form identifiers from a single authenticated session
Alert on approval flow edits performed outside of business hours or by users without an administrative role

Monitoring Recommendations

Forward Kiteworks audit and access logs to a centralized SIEM for retention and correlation
Build queries that join form ownership metadata with configuration change events to surface cross-user modifications
Track API error rates and 200-response anomalies on form configuration endpoints to detect probing activity

How to Mitigate CVE-2026-23638

Immediate Actions Required

Upgrade Kiteworks to version 9.3.0 or later, which contains the vendor-supplied fix
Audit existing Secure Data Forms approval flows for unauthorized modifications since the vulnerable versions were deployed
Rotate sessions and review accounts with form configuration access for unusual activity

Patch Information

Kiteworks addressed the vulnerability in version 9.3.0. Administrators should consult the Kiteworks Security Advisory GHSA-8wmh-mg2h-hf46 for upgrade procedures and verification steps. Confirm the installed build reports 9.3.0 or later after patching.

Workarounds

No vendor-supplied workaround exists; upgrading to 9.3.0 is the supported remediation
Restrict authenticated access to trusted users until the patch is applied
Increase audit log review cadence for form configuration changes during the remediation window

bash

# Verify Kiteworks version after upgrade
# Replace <host> with your Kiteworks appliance hostname
curl -sk https://<host>/rest/version | grep -i version