CVE-2026-102107

Name of the Vulnerable Software and Affected Versions Kiteworks Core (affected versions not specified)

Description A business logic flaw exists in the file-request feature. An authenticated user can send a request that appears to originate from another user because the server fails to verify if the requester is authorized to act as the specified account. This allows an attacker to solicit files or information from a recipient by impersonating a trusted identity. Exploitation requires the file-request feature to be enabled for the attacker's profile and the recipient to act upon the request.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.