CVE-2026-102139

Received Received - Intake

Authorization Bypass in Kiteworks Email Protection Gateway

Publication date: 2026-09-30

Last updated on: 2026-09-30

Assigner: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Description

An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of packages they neither sent nor received.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-30

Last Modified

2026-09-30

Generated

2026-10-01

AI Q&A

2026-10-01

EPSS Evaluated

N/A

NVD

CVE-2026-102139

EUVD

EUVD-2026-90275

Affected Vendors & Products

Vendor	Product	Version / Range
kiteworks	email_protection_gateway	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is in the large file exchange feature of Kiteworks Email Protection Gateway. It involves an authorization check that fails to verify if the requesting user is part of the package being accessed. As a result, authenticated users can read the subject, message body, and attachments of packages they did not send or receive.

Impact Analysis

If you use the affected Kiteworks Email Protection Gateway feature, an attacker with valid credentials could access sensitive information in packages they are not authorized to view. This includes email subjects, messages, and attachments, potentially leading to data breaches or unauthorized information disclosure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations may face legal penalties, reputational damage, and loss of trust due to non-compliance resulting from this flaw.

Mitigation Strategies

Apply the latest security patches or updates provided by Kiteworks for the Email Protection Gateway to fix the authorization check flaw in the large file exchange feature.

Hi! I’m here to help you understand CVE-2026-102139. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70