CVE-2026-102122

Analyzed Analyzed - Analysis Complete

Kiteworks Folder Manager Privilege Escalation

Publication date: 2026-09-30

Last updated on: 2026-10-07

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager role on a folder could grant the Owner role to themselves or to other members of that folder.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-10-07

Generated

2026-10-19

AI Q&A

2026-10-01

EPSS Evaluated

2026-10-18

NVD

CVE-2026-102122

EUVD

EUVD-2026-90296

Affected Vendors & Products

Vendor	Product	Version / Range
accellion	kiteworks	to 9.5.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

Kiteworks did not properly restrict role assignments in shared folders. An authenticated user with the Manager role could grant the Owner role to themselves or others, potentially escalating their privileges beyond intended limits.

Detection Guidance

This vulnerability involves improper role enforcement in shared folders. To detect it, review folder access logs for unauthorized role changes to Owner by users with Manager role. Check if any Manager assigned Owner role to themselves or others without proper permissions.

Impact Analysis

This could allow unauthorized users to gain elevated access, leading to data exposure, unauthorized modifications, or loss of control over shared folders and their contents.

Compliance Impact

This vulnerability may violate compliance requirements by enabling unauthorized access to sensitive data, potentially leading to data breaches and non-compliance with GDPR, HIPAA, or other regulations.

Mitigation Strategies

Review and update folder role assignment permissions to ensure only authorized users can assign the Owner role. Verify that default configurations do not allow unauthorized role escalation.

Hi! I’m here to help you understand CVE-2026-102122. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70