Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-102132 Details

Description

An administrative import function in Kiteworks Core did not verify that the requesting administrator was entitled to create the privileged integration credential being imported. A delegated administrator holding a single narrowly scoped administrative permission could therefore obtain full system administrator privileges, without any action by an existing system administrator.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian GovernmentCVSS-B:7.2 HIGHVector:CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-qx8c-x3hv-c25g	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-284	Improper Access Control	Cybersecurity and Infrastructure Security Agency (CISA) U.S. Civilian Government

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes