---
id: CVE-2025-53900
title: Kiteworks MFT orchestrates end-to-end file transfer workflows
summary: >-
  Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to
  version 9.1.0, an unfavourable definition of roles and permissions in
  Kiteworks MFT on managing Connections could lead to unexpected escalation of
  privileges for aut…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'
cwe:
  - CWE-267
vendor: accellion
product: kiteworks_managed_file_transfer
affected:
  - kiteworks_managed_file_transfer < 9.1.0
patched:
  - kiteworks_managed_file_transfer 9.1.0
published: '2025-11-29'
updated: '2026-10-07'
sourceUpdated: '2026-10-07T20:10:01.970'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-53900'
references:
  - url: >-
      https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gjq3-8v6p-2h6h
    label: security-advisories@github.com
tags:
  - nvd
epss: 0.01138
epssPercentile: 0.65501
ingestedAt: '2026-10-07T20:46:46.738Z'
---

## Overview

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This issue has been patched in version 9.1.0.

## Affected

- `kiteworks_managed_file_transfer < 9.1.0`

## Remediation

Upgrade past the affected range:

- `kiteworks_managed_file_transfer 9.1.0`