CVE-2026-102107

Received Received - Intake

Business Logic Flaw in Kiteworks Core File-Request Feature

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

Kiteworks Core contains a business logic flaw in a Kiteworks file-request feature allowed an authenticated user to send a request that appeared to originate from another user, because the server did not verify that the requester was authorized to act as the specified account. This could be used to solicit files or information from a recipient under a trusted identity; exploitation requires the feature to be enabled for the attacker's profile and the targeted recipient to act on the request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102107

EUVD

EUVD-2026-90312

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	kiteworks_core	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

Kiteworks Core has a flaw where an authenticated user can send a file request pretending to be another user. The server fails to verify if the requester is authorized to act as the specified account. This requires the feature to be enabled for the attacker and the recipient to trust the request.

Detection Guidance

This vulnerability requires checking if the Kiteworks file-request feature is enabled for user profiles and verifying if requests are properly authenticated. Review Kiteworks logs for suspicious file requests where the requester identity does not match the actual user. Check for requests with mismatched sender and actor fields in the request logs.

Impact Analysis

An attacker could trick you into sending sensitive files or information by impersonating a trusted user. This could lead to data leaks or unauthorized access to confidential data if you act on the fraudulent request.

Compliance Impact

This vulnerability could violate GDPR by exposing personal data or HIPAA by leaking protected health information if exploited. Organizations may fail compliance due to inadequate access controls and verification mechanisms.

Mitigation Strategies

Disable the file-request feature for users if it is enabled. Ensure all user requests are properly authenticated and authorized to prevent impersonation. Review logs for suspicious activity where requests appear to originate from unexpected accounts.

Hi! I’m here to help you understand CVE-2026-102107. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70