CVE-2026-102115

critical · 9.8

Kiteworks Core did not correctly validate a parameter submitted to the password reset workflow. An unauthenticated attacker who knew the email address of a user with a locally stored password could potentially reset that account's password without access to the emailed reset link and then authenticate as that user, including where the account holds administrative privileges.

9.8

CVSS

0.5%

EPSS (exploit prob.)

43rd

EPSS percentile

2026-09-30

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-640

References

https://github.com/kiteworks/security-advisories/security/advisories/GHSA-q76w-qv9j-q639
https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2026-102115