PT-2026-103548

CVE-2026-102115

Published

2026-09-30

Updated

2026-10-07

Description by

CVSS 3.1

9.8

Critical

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Kiteworks Core versions prior to 9.5.1

Description Kiteworks Core fails to correctly validate a parameter within the password reset workflow. This allows an unauthenticated attacker who knows the email address of a user with a locally stored password to reset the account password without access to the reset link sent via email. This can lead to full account takeover, including accounts with administrative privileges.

Recommendations Update Kiteworks Core to version 9.5.1.

Exploitability

Fix

Researchers

Vendors

Affected products

Weakness enumeration

CWE-640: Weak Password Recovery Mechanism for Forgotten Password