7.2

CVE-2026-102132

Kiteworks Core Privilege Escalation through Improper Access Control

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system administrator privileges, without any action by an existing system administrator.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Accellion ≫ Kiteworks Version < 9.5.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.34% 0.246
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
cisa-cg 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json
Broken Link
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qx8c-x3hv-c25g
Vendor Advisory