CVE-2026-23638

MediumCVSS 6.5/10Last modified Jul 22, 2026

Description

Kiteworks is a private data network (PDN). Prior to version 9.3.0, an Insecure Direct Object Reference (IDOR) vulnerability in Kiteworks Secure Data Forms allows an authenticated attacker to tamper with the internal approval flow configurations of forms belonging to other users due to insufficient authorization checks on resource ownership. Upgrade Kiteworks to version 9.3.0 or later to receive a patch.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Jun 1, 2026
Last modified: Jul 22, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-23647.3If a legitimate user confirms a self-update prompt or initiate an installation of a CODESYS Development System, a low privileged local attac CVE-2026-236435.4CakePHP is a rapid development framework for PHP. The PaginatorHelper::limitControl() method has a cross-site-scripting vulnerability via qu CVE-2026-236447.5esm.sh is a no-build content delivery network (CDN) for web development. Prior to Go pseeudoversion 0.0.0-20260116051925-c62ab83c589e, the s CVE-2026-236456.1SiYuan is self-hosted, open source personal knowledge management software. Prior to 3.5.4-dev2, a Stored Cross-Site Scripting (XSS) vulnerab CVE-2026-236466.5OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the abil CVE-2026-236479.8Glory RBG-100 recycler systems using the ISPK-08 software component contain hard-coded operating system credentials that allow remote authen CVE-2026-236487.8Glory RBG-100 recycler systems using the ISPK-08 software component contain multiple system binaries with overly permissive file permissions CVE-2026-23657.2The Fluent Forms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `fluentform_step_form_save_data` AJAX action CVE-2026-236516.7Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.CVE-2026-236529.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker CVE-2026-236536.5Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an autho CVE-2026-236548.8Dependency on vulnerable third-party component in GitHub Repo: zero-shot-scfoundation allows an unauthorized attacker to execute code over a