Kiteworks Core CVE-2026-102129

Requires an authenticated Kiteworks Core administrator whose delegated permissions include role changes (user-provisioning/role management) but who is NOT intended to grant the system-administrator role. Exploitation is performed through the user-provisioning interface, which fails to verify the requester is entitled to grant the role being assigned. Limiting factors: the attacker must already possess valid privileged (delegated-admin) credentials/session (PR:H), so this is not exploitable by anonymous or ordinary-user accounts; environments that do not use scoped/delegated admin roles have no meaningful trust boundary to cross. No user interaction is required (UI:N).

This is a genuine privilege-escalation flaw but a LOW-to-MEDIUM operational priority, not a high-urgency issue despite the 7.2 (HIGH) score. The vendor CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H is well-founded and I concur: the PR:H is the decisive limiter - exploitation requires an already-authenticated administrator who holds delegated role-management permissions, so this is a trust-boundary/least-privilege failure among privileged operators rather than an externally reachable break-in. There is no EPSS score, no CISA KEV listing, and no public exploit identified at time of analysis, so all real-world-exploitation signals are absent; risk is bounded to environments that deploy delegated/scoped administrator roles and trust those delegates less than full sysadmins. The network attack vector (AV:N) reflects the web management interface but does not lower the authentication bar. The C:H/I:H/A:H triad is justified because escalation to full system-administrator yields total control of the Kiteworks appliance. No signals conflict; the main caveat is a mislabeled tag (see data_quality_flags) - the 'Information Disclosure' tag understates this, which is a full privilege-escalation/takeover primitive.

An organization delegates limited administrative duties - such as managing user roles - to a helpdesk or team lead, expecting they cannot create super-admins. That delegated administrator uses the user-provisioning interface to assign the full system-administrator role to an account they control, and because the interface never checks whether the requester is entitled to grant that role, the assignment succeeds and yields complete appliance takeover. No public exploit code is available, and the attacker must already hold an authenticated delegated-admin session (PR:H).