CVE-2026-102139: Kiteworks Email Protection Gateway Incorrect Authorization
Published Sep 30, 2026
·Updated
An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of packages they neither sent nor received.
Affected Software
2 affected components
Kiteworks Email Protection Gateway
Accellion Kiteworks<9.5.1
Event History
Sep 30, 2026
CVE Published
via MITRE·08:11 PM
Data Sourced
via MITRE·08:11 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·09:17 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this issue?
An attacker must be an authenticated user of the large file exchange feature. That feature is described as optional.
2
What information could an unauthorized user access?
They could read the subject, message body, and attachments of packages that they neither sent nor received.