CVE-2026-102126

Name of the Vulnerable Software and Affected Versions Kiteworks Core (affected versions not specified)

Description A stored cross-site scripting (XSS) weakness allows an administrator with limited delegated permissions to store crafted content. When a System Administrator views the affected page, arbitrary JavaScript executes within their authenticated session. This flaw can enable a lower-privileged administrator to escalate privileges to full administrative control of the tenant, which includes the ability to create new administrative accounts.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.