Kiteworks Core EUVD-2026-90296

Exploitable in a DEFAULT Kiteworks Core configuration (no special setting required), but the attacker must already be an authenticated user holding the Manager role on the target shared folder (PR:L). The escalation is scoped to that folder - the Manager grants the Owner role on the same folder to themselves or other members - so it does not by itself yield tenant-wide or system-administrator privileges. Affected: Kiteworks Core versions below 9.5.1; upgrade to 9.5.1 remediates.

This is a genuine but low-priority authorization flaw. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N = 4.3, Medium) is internally consistent with the description and I agree with it: network-reachable, low complexity, but requiring existing authenticated access at the Manager level (PR:L), with impact limited to integrity (I:L) and no confidentiality or availability effect. There is no EPSS score, no CISA KEV listing, and no public exploit code provided, so all exploitation-likelihood signals point to low real-world urgency - this reads as a targeted, insider-style privilege manipulation rather than a mass-exploitable flaw. No SSVC decision content was supplied. The key limiting factors are that the attacker must already hold the Manager role on a folder and the escalation is scoped to Owner of that same folder (not a jump to system/tenant administrator), which caps the blast radius well below the platform-takeover priv-esc CVEs in the same batch. No conflicting signals were found between the CVSS vector and the description.

An authenticated user who has been delegated the Manager role on a shared folder abuses the missing role-assignment restriction to grant themselves (or a colluding member) the Owner role on that folder in a default Kiteworks configuration. As Owner they gain full control over the folder's contents, membership, and settings beyond what their delegation was intended to allow. No public exploit code is available at time of analysis.