EUVD-2026-90275Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Authenticated network user (PR:L) abuses missing object-level authorization with low complexity to read others' data; confidentiality-only, so I:N/A:N.
Primary rating from Vendor (cisa-cg).
CVSS VectorVendor: cisa-cg
Lifecycle Timeline
4DescriptionCVE.org
An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of packages they neither sent nor received.
AnalysisAI
Authenticated users of Kiteworks Email Protection Gateway versions before 9.5.1 can read the subject, message body, and attachments of large file exchange packages they neither sent nor received. Exploitation requires a valid account (PR:L) and the optional large file exchange feature to be enabled and in use; no public exploit has been identified at time of analysis. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account on the Kiteworks Email Protection Gateway (PR:L) AND the optional 'large file exchange' feature to be enabled and in use - the description explicitly scopes the flaw to 'that optional feature.' Given those, a network attacker with low complexity and no user interaction reads the subject, body, and attachments of packages they neither sent nor received by manipulating the package reference. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All signals converge on a moderate, not urgent, priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Kiteworks Email Protection Gateway version 9.5.1 or later; this is the vendor-released patch that remediates the authorization flaw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthenticated attackers who know a target's email address can take over Kiteworks Core accounts that use locally store
Improper certificate-assignment controls in Kiteworks Email Protection Gateway allow a remote, unauthenticated attacker
Stored cross-site scripting in Kiteworks Core (all versions prior to 9.5.0) enables unauthenticated attackers to persist
Authentication bypass in Kiteworks Email Protection Gateway (versions before 9.5.0) lets unauthenticated remote attacker
Server-side request forgery in Kiteworks Email Protection Gateway (versions before 9.5.0) lets a remote, unauthenticated
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated sender t
Unauthenticated server-side request forgery in Kiteworks Email Protection Gateway before version 9.5.0 lets a remote att
Server-side request forgery in Kiteworks Email Protection Gateway before 9.5.0 allows a remote, unauthenticated attacker
Server-side request forgery in Kiteworks Email Protection Gateway (all versions before 9.5.0) lets a remote, unauthentic
Command injection in Kiteworks Core's internal cluster-management function allows an attacker who already has code execu
Sandbox escape in Kiteworks Core's document-conversion feature (CVE-2026-102125, CVSS 8.8) allows code already executing
Authenticated privilege escalation in Kiteworks PDN (the Accellion-line private data network) before version 9.1.0 lets
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today