CVEvulnerability
CVE-2026-102115
9.8 CRITICAL
Official page ↗
- Status
- Analyzed
- Published
- 2026-09-30
- Last modified
- 2026-10-07
- Assigner
- 9119a7d8-5eab-497f-8521-727c672e3725
- CVSS 3.1 (9119a7d8-5eab-497f-8521-727c672e3725)
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-640
Description
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.
Affected configurations
• accellion kiteworks (< 9.5.0)
Related
Weakness · CWE (1)
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password weakness