CVE-2026-102129

7.2 Élevée

Publiée le 30/09/2026 à 23:17 · Modifiée le 08/10/2026 à 15:44 · Analysée par le NVD · Source : 9119a7d8-5eab-497f-8521-727c672e3725

Description

A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges.

Traduire en français

Produits concernés

Kiteworks Core
Accellion kiteworks

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.2 Élevée	9119a7d8-5eab-497f-8521-727c672e3725	`CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-266

Références

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-4gcf-w86v-34rp Vendor Advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json Broken Link

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories