---
id: CVE-2026-102129
title: >-
  A user-provisioning interface in Kiteworks Core did not verify that the
  requesting administrator was entitled to grant the role being assigned
summary: >-
  A user-provisioning interface in Kiteworks Core did not verify that the
  requesting administrator was entitled to grant the role being assigned. An
  administrator whose delegated permissions covered role changes alone could
  therefore raise…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-266
vendor: accellion
product: kiteworks
affected:
  - kiteworks < 9.5.1
patched:
  - kiteworks 9.5.1
published: '2026-09-30'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T13:44:24.597'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102129'
references:
  - url: >-
      https://github.com/kiteworks/security-advisories/security/advisories/GHSA-4gcf-w86v-34rp
    label: 9119a7d8-5eab-497f-8521-727c672e3725
  - url: >-
      https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json
    label: 9119a7d8-5eab-497f-8521-727c672e3725
tags:
  - nvd
  - cve.org
epss: 0.00836
epssPercentile: 0.5753
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-01T13:28:22.003260Z'
ingestedAt: '2026-09-30T21:25:07.832Z'
---

## Overview

A user-provisioning interface in Kiteworks Core did not verify that the requesting administrator was entitled to grant the role being assigned. An administrator whose delegated permissions covered role changes alone could therefore raise an account to full system-administrator privileges.

## Affected

- `kiteworks < 9.5.1`

## Remediation

Upgrade past the affected range:

- `kiteworks 9.5.1`