CVE-2026-102115
CRITICAL
NVD
CVSS Score
9.8
Severity
CRITICAL
Published
Sep 30, 2026
Vendor
unknown
Description
Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.