CVE-2026-102115

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.

Score

CVSS 3.1 9.8 Critical

Status

Analyzed - 9119a7d8-5eab-497f-8521-727c672e3725

Published

2026-09-30

Last modified

2026-10-07

Weaknesses

CWE-640

Affected products

• Kiteworks (Accellion)
• Core (Kiteworks)

References

• https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639
• https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json