CVE-2026-102149: Kiteworks Email Protection Gateway Improper Access Control
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where certificate-based login is enabled, potentially permitting unauthorized access to the account.
Affected Software
Event History
Frequently Asked Questions
What must an attacker be able to do to exploit this issue?
The attacker needs to be able to associate a certificate with another user’s account. The available information does not specify any required authentication or prior access, while the supplied vector indicates no privileges or user interaction are required.
Which environments face the greatest impact?
Deployments using encrypted mail are affected because another user’s certificate association can compromise that account’s mail confidentiality and integrity. Environments that enable certificate-based login may also face unauthorized account access.
How can I determine whether certificate-based login increases my exposure?
Review whether certificate-based login is enabled in your Kiteworks Email Protection Gateway deployment. If it is enabled, an improper certificate-to-account association could potentially be used to access the affected account.