---
id: CVE-2026-102093
title: >-
  Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege
  Management and does not correctly enforce restrictions on role assignment,
  which could allow an authenticated administrative user with limited,
  non-Sysadmin role-man…
summary: >-
  Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege
  Management and does not correctly enforce restrictions on role assignment,
  which could allow an authenticated administrative user with limited,
  non-Sysadmin role-man…
severity: high
cvss: 7.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
vendor: Kiteworks
product: Core
affected:
  - Core < 9.5.0
published: '2026-09-30'
updated: '2026-09-30'
sourceUpdated: '2026-09-30T21:16:55.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-102093'
references:
  - url: >-
      https://github.com/kiteworks/security-advisories/security/advisories/GHSA-mq6c-p42h-75j5
    label: 9119a7d8-5eab-497f-8521-727c672e3725
  - url: >-
      https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json
    label: 9119a7d8-5eab-497f-8521-727c672e3725
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-30T21:25:07.820Z'
---

## Overview

Kiteworks Core before version 9.5.0 is vulnerable to Improper Privilege Management and does not correctly enforce restrictions on role assignment, which could allow an authenticated administrative user with limited, non-Sysadmin role-management permissions to elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.