CVE-2026-102122

MediumCVSS 4.3/10Last modified Oct 7, 2026

Description

Kiteworks did not correctly enforce which roles a shared folder's manager was permitted to assign. In a default configuration, an authenticated user holding the Manager role on a folder could grant the Owner role to themselves or to other members of that folder.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Sep 30, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1021237.4A Kiteworks appliance setup interface did not confine a user-supplied file path to its intended directory, which could allow an unauthentica CVE-2026-1021246.5A Kiteworks appliance setup interface did not enforce authentication once the appliance had completed initial configuration. An unauthentica CVE-2026-1021258.8The sandbox that isolates document conversion on a Kiteworks appliance did not fully confine the code running inside it. Code already execut CVE-2026-1021268.1A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated CVE-2026-1021277.0An XML parser used by Kiteworks Email Protection Gateway did not restrict external entity references. Where an optional, non-default message CVE-2026-1021287.5An identity-verification weakness in Kiteworks Email Protection Gateway allowed the gateway to act on the Kiteworks platform on behalf of a CVE-2026-1021297.2A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assign CVE-2026-102135.4A security flaw has been discovered in AstrBotDevs AstrBot 4.23.6. This vulnerability affects unknown code of the file /api/skills/delete of CVE-2026-1021307.2Kiteworks Email Protection Gateway did not sufficiently validate the content of an uploaded backup, and allowed an administrator to influenc CVE-2026-1021317.2Kiteworks Email Protection Gateway rejected certain configuration settings, but its validation did not recognize every form in which they co CVE-2026-1021327.2An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged i CVE-2026-1021336.6An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied pat