CVE-2026-102111

MediumCVSS 4.9/10Last modified Oct 7, 2026

Description

Kiteworks did not enforce the maximum permitted value for a configurable security-policy setting. An authenticated administrator could set this value outside its intended range so that the associated control never activated, while the control continued to appear enabled in the administrative interface and audit log, allowing it to be silently rendered ineffective.

Metrics

CVSS 3.1 4.9/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-1284

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1021127.8A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend CVE-2026-1021137.8A privilege escalation vulnerability in Kiteworks could allow an attacker who has already obtained code execution as an unprivileged backend CVE-2026-1021147.2A command injection vulnerability in Kiteworks could allow a high-privileged authenticated administrator to execute arbitrary operating-syst CVE-2026-1021159.8Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the ema CVE-2026-1021167.2-A weakness could have allowed an authenticated Kiteworks Email Protection Gateway administrator to write a file outside its intended locati CVE-2026-1021177.2On deployments where the remote-support capability is licensed and enabled, an authenticated System Administrator who also possessed the key CVE-2026-1021187.8A local privilege escalation vulnerability in Kiteworks could have allowed an attacker with an existing shell under a low-privileged service CVE-2026-1021197.2A path traversal weakness in an optional, non-default administrative feature allowed an authenticated administrator to move files to uninten CVE-2026-102126.3A vulnerability was identified in AstrBotDevs AstrBot 4.24.2. This affects the function astr_main_agent of the file astrbot/core/astr_main_a CVE-2026-1021208.8A privilege escalation vulnerability in Kiteworks could have allowed an attacker who had already obtained code execution on one node of a cl CVE-2026-1021218.6A form-rendering interface in the Advanced Forms component is reachable without authentication so that published forms can be displayed to a CVE-2026-1021224.3Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authentica