CVE-2026-102129

published 2026-09-30

CVE-2026-102129: A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An…

Priority P3 46 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
kiteworks	core	< 9.5.1	9.5.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-266