« Volver al listado

CVE-2026-102093

Estado: Pendiente de análisisAlta (7.2)—

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Kiteworks — Kiteworks CoreAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-102093",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "9119a7d8-5eab-497f-8521-727c672e3725",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "affectedData": [
        {
          "vendor": "Kiteworks",
          "product": "Core",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "9.5.0",
              "versionType": "custom"
            },
            {
              "status": "unaffected",
              "version": "9.5.0"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2026-09-30T21:16:55.870",
  "references": [
    {
      "url": "https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mq6c-p42h-75j5",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    },
    {
      "url": "https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "9119a7d8-5eab-497f-8521-727c672e3725",
      "description": [
        {
          "lang": "en",
          "value": "CWE-269"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant."
    }
  ],
  "lastModified": "2026-10-01T02:17:43.350",
  "sourceIdentifier": "9119a7d8-5eab-497f-8521-727c672e3725"
}