CVE-2026-102126

Summary

A stored cross-site scripting (XSS) vulnerability allows a low-privileged administrator to inject JavaScript, potentially escalating to full administrative control.

Exploitability

Exploitation requires a single, narrowly scoped delegated permission and an authenticated session of a System Administrator. The vulnerability is relatively hard to exploit due to the specific permission requirements.

Blast radius

If exploited, the attacker could gain full administrative control over the tenant, including creating new administrative accounts.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to the latest version of Kiteworks Core as soon as possible.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.