Kiteworks Core EUVD-2026-90291

Exploitation requires an authenticated administrator account that holds at least one narrowly-scoped delegated permission allowing content to be stored on an administrative page (PR:H) - anonymous exploitation is not possible. The stored payload only executes when a higher-privileged System Administrator subsequently views the affected page (UI:R), so success depends on that victim interaction. This makes the flaw relevant specifically to Kiteworks Core tenants that use delegated/role-based administration with multiple admin tiers; single-admin or no-delegation deployments have a much smaller attack surface.

The vendor CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N, 8.1) is internally coherent for a stored-XSS privilege-escalation chain and I agree with it. The elevated PR:H is well-justified: the attacker must already hold a valid, though narrowly-scoped, delegated administrator account - this is not an anonymous internet-facing flaw. UI:R and S:C are correct because the payload only fires when a higher-privileged System Administrator views the poisoned page (user interaction), and execution then crosses a privilege boundary into the victim's authenticated session (scope change). No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation status is 'no public exploit identified at time of analysis.' The 8.1 High score is driven largely by the tenant-takeover consequence (C:H/I:H), but real-world urgency is tempered by the two gating conditions: the attacker needs pre-existing delegated admin access AND must wait for a sysadmin to visit the affected page. This is therefore a genuine escalation risk in multi-admin/delegated-administration tenants, but not a mass-exploitable remote flaw - closer to an insider or compromised-low-admin threat model than a wormable vulnerability.

A low-trust delegated administrator (holding only one narrow permission) injects a crafted JavaScript payload into a field that is later rendered on an administrative page. When a full System Administrator opens that page, the script executes in their authenticated browser session and silently performs privileged actions - such as creating a brand-new administrative account - handing the attacker full tenant control. No public exploit code has been identified, and success depends on a sysadmin actually viewing the poisoned content.