CVE-2026-102115

Received
Published: 30 Sept 2026, 20:19
Last modified:30 Sept 2026, 20:19

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
9.8 CRITICAL
v3.1 (cve.org)
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

30 Sept 2026, 20:19
Published
Vulnerability first disclosed

Description

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.

CVSS Metrics

  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Techniques & Countermeasures

  • CWE-640•Weak Password Recovery Mechanism for Forgotten Password

    The product contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.

Affected Systems

  • kiteworks•core

    < 9.5.0

References (2)