CVE-2026-102139

6.5 Moyenne

Publiée le 30/09/2026 à 23:17 · Modifiée le 07/10/2026 à 17:01 · Analysée par le NVD · Source : 9119a7d8-5eab-497f-8521-727c672e3725

Description

An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of packages they neither sent nor received.

Traduire en français

Produits concernés

Kiteworks Email Protection Gateway
Accellion kiteworks

Scores CVSS

Version	Score	Source	Vecteur
3.1	6.5 Moyenne	9119a7d8-5eab-497f-8521-727c672e3725	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-639
CWE-863

Références

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-fp46-xhg8-vpgm Vendor Advisory
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json Broken Link

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories