CVE-2026-102115

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.1

Description Kiteworks Core fails to correctly validate a parameter within the password reset workflow. This allows an unauthenticated attacker who knows the email address of a user with a locally stored password to reset the account password without access to the reset link sent via email. This can lead to full account takeover, including accounts with administrative privileges.

Recommendations Update Kiteworks Core to version 9.5.1.