Kiteworks Core EUVD-2026-90281

Requires a valid authenticated session on the Kiteworks Core platform via its central authentication service (PR:L) - this is not unauthenticated. The distinguishing condition is that exploitation targets a specific REST API request path on which the gateway-level API security controls are not applied; on that path, enforcement of signed-out and revoked sessions is absent, so a terminated/revoked session can still act. No user interaction is needed (UI:N) and the network vector applies to default configurations, but the impact ceiling is low (C:L/I:L, A:N). Limiting factors: attacker must already possess or have possessed platform credentials/session, and only the functionality reachable on the unprotected path is affected.

This is a genuine but modest-severity access-control weakness, not a high-impact flaw. The vendor CVSS of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) is internally consistent with the description: exploitation is network-reachable and low-complexity but requires an already-authenticated account (PR:L), and impact is limited to low confidentiality and low integrity with no availability effect. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or imminent exploitation - treat exploitation status as no public exploit identified at time of analysis. The core risk is a session-lifecycle bypass: because gateway-level API controls (including enforcement of signed-out and revoked sessions) are not applied on one REST path, a session that should be terminated may still perform limited API actions. This makes it most relevant to insider-threat, stolen-session, or post-compromise scenarios rather than mass exploitation. No key signals conflict, though note the low CIA metrics mean this is a defense-in-depth gap rather than a direct route to takeover.

An authenticated Kiteworks user (or an attacker holding a session that has since been logged out or administratively revoked) sends requests to the specific REST API path where the central authentication gateway controls are not enforced. Because signed-out/revoked-session checks are skipped on that channel, the actor continues to invoke limited REST functionality despite the session being nominally terminated. No public exploit code is identified; low attack complexity means a knowledgeable authenticated user could reproduce it reliably once the unprotected path is known.