CVE-2026-102129: Kiteworks Core Incorrect Privilege Assignment

Q: Which administrators are exposed to this privilege escalation?

Administrators with delegated permission to change roles are exposed if they are not separately authorized to grant the role they assign. Such an administrator could elevate an account to full system-administrator privileges.

Q: What access does an attacker need to exploit this issue?

The attacker needs administrator-level access with delegated role-change permissions. No user interaction is required.

Published Sep 30, 2026

Updated

A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges.

Affected Software

2 affected components

Kiteworks Core

Accellion Kiteworks<9.5.1

Event History

Sep 30, 2026

CVE Published

via MITRE·08:14 PM

Data Sourced

via MITRE·08:14 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which administrators are exposed to this privilege escalation?

Administrators with delegated permission to change roles are exposed if they are not separately authorized to grant the role they assign. Such an administrator could elevate an account to full system-administrator privileges.

What access does an attacker need to exploit this issue?