CVE-2026-102132: Kiteworks Core Privilege Escalation through Improper Access Control
An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system administrator privileges, without any action by an existing system administrator.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must already be a delegated administrator with the narrowly scoped administrative permission that allows use of the affected import function. No interaction from an existing system administrator is required.
What could a successful attacker gain?
A successful attacker could create a privileged integration credential and use it to obtain full system administrator privileges. The stated impact includes complete compromise of confidentiality, integrity, and availability.
Is this exploitable remotely?
The CVSS vector identifies network access and low attack complexity, with no user interaction required. Exploitation still requires prior delegated-administrator privileges.