4.6

CVE-2026-102107

Kiteworks Core user impersonation in a file-request feature

Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was authorized to act as the specified account. This could be used to solicit files or information from a recipient under a trusted identity; exploitation requires the feature to be enabled for the attacker's profile and the targeted recipient to act on the request.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Accellion ≫ Kiteworks Version < 9.5.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.16% 0.047
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cisa-cg 4.6 2.1 2.5
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json
Broken Link
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-wv69-6ghf-h3c4
Vendor Advisory