CVE-2026-102122: Kiteworks Core Incorrect Authorization
Published Sep 30, 2026
·Updated
Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager role on a folder could grant the Owner role to themselves or to other members of that folder.
Affected Software
1 affected component
Kiteworks Kiteworks Core
Event History
Sep 30, 2026
CVE Published
via MITRE·08:16 PM
Data Sourced
via MITRE·08:16 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue in a default deployment?
An authenticated user who already holds the Manager role on a shared folder can exploit it. The issue is present in the default configuration described.
2
What access can an attacker gain through exploitation?
The folder Manager can assign themselves the Owner role, or grant the Owner role to other members of that folder. This results in unauthorized elevation of folder-level privileges.
3
Does exploitation require user interaction or a complex attack?
No user interaction is required. The attack can be performed over the network by an authenticated user with the required Manager role.