CVE-2026-102129

7.2 HIGHpublic exploit available

Published 2026-09-30 · Updated 2026-10-01

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-266

Public exploit & PoC references

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-4gcf-w86v-34rp

All references

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-4gcf-w86v-34rp
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

CRITICALCVE-2026-10059
HIGHCVE-2026-100619PoC
MEDIUMCVE-2026-100883PoC
HIGHCVE-2026-101053PoC
MEDIUMCVE-2026-101054PoC
MEDIUMCVE-2026-101144
HIGHCVE-2026-101860PoC
HIGHCVE-2026-102293PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.