CVE-2026-102093

Executive Summary

CVE-2026-102093 is an improper privilege management vulnerability (CWE-269) in Kiteworks Core affecting versions before 9.5.0. An authenticated administrative user who holds only limited, non-Sysadmin role-management permissions can assign another user the full system-administrator role — privileges they themselves are not authorized to grant. Successful exploitation yields complete administrative control of the Kiteworks platform, with high impact to confidentiality, integrity, and availability (CVSS 7.2).

Technical Analysis

The vulnerability resides in Kiteworks Core's role-assignment authorization logic. The NVD description states that the product "does not correctly enforce restrictions on role assignment," permitting an authenticated administrative user with "limited, non-Sysadmin role-management permissions" to "elevate another user to full system-administrator privileges beyond those the administrative user was authorized to grant."

This is a horizontal/vertical privilege escalation of the authorization-bypass class, mapped to CWE-269 (Improper Privilege Management). The core flaw is a missing or incorrect authorization check on the role-assignment operation: the application validates that the caller is an administrator, but fails to validate that the caller is permitted to grant the specific target role. As a result, any administrative account with delegated role-management rights can write a role value (system administrator) that exceeds its own entitlement ceiling.

Key technical characteristics derivable from the description:

• Attack vector: Network (AV:N). The role-assignment function is exposed through the web management interface, so the attack is remote and does not require local access.
• Authentication requirement: The attacker must already possess a valid authenticated session with administrative privileges (PR:H). This is not a pre-authentication flaw; it is a post-authentication authorization-boundary failure.
• Complexity: Low (AC:L). The flaw is triggered through normal use of the role-management feature; no race conditions, memory corruption, or special conditions are described.
• User interaction: None (UI:N). The privilege-granting action is performed by the attacker's own request, not a victim's interaction.
• Scope: Unchanged (S:U). The exploit affects the Kiteworks application authorization domain; the description does not indicate cross-component impact.

The precise internal mechanism (e.g., whether the check is missing entirely, evaluated against the wrong object, or bypassable via parameter manipulation) cannot be determined from the available advisory text. No function names, API endpoints, request parameters, or code paths are disclosed. What is certain from the description is the failure mode: an authority ceiling is not enforced when a role assignment is committed.

The privilege boundary being broken — the distinction between "limited role-management permissions" and "full Sysadmin" — is the security control that Kiteworks relies on to delegate administrative duties safely. Because the check is not enforced at the point of role assignment, the entire tiered-administration model collapses.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is available for CVE-2026-102093. The following attack chain is inferred strictly from the vulnerability class (improper privilege management / authorization bypass in role assignment) and the NVD description.

1. Reconnaissance / target identification. The attacker identifies an internet- or intranet-exposed Kiteworks Core deployment running a version below 9.5.0. Reconnaissance focuses on confirming the version through login banners, asset fingerprinting, or authenticated enumeration. The attacker requires valid credentials for an administrative account — either their own delegated administrative account, a compromised low-tier admin account, or credentials obtained through separate means.

2. Authentication and privilege baseline. The attacker logs into the Kiteworks Core administration interface with an account whose permissions are limited to role management but explicitly exclude Sysadmin authority. Per the advisory, this account is supposed to be unable to grant system-administrator privileges to anyone.

3. Triggering the flaw. Using the role-management functionality available to this delegated administrator, the attacker performs a role-assignment action — assigning a target account (one they control, or a colluding account) the system-administrator role. The vulnerable versions "do not correctly enforce restrictions on role assignment," so the application accepts and commits the assignment even though the caller is not authorized to grant Sysadmin. At the vulnerability-class level, this is an authorization check bypass: the operation succeeds because the ceiling on grantable roles is not applied to the caller's request. No specific endpoint, parameter, or request structure is disclosed in the advisory and none is assumed here.

4. Post-exploitation impact. Once the target account holds full system-administrator privileges, the attacker has effectively self-elevated (or elevated an accomplice) from a constrained administrative role to the highest privilege tier in the product. From full Sysadmin, the attacker controls platform configuration, user and data access, and administrative functions — a complete compromise of the Kiteworks instance's confidentiality, integrity, and availability, consistent with the CVSS impact values (C:H/I:H/A:H).

Detection opportunity: the privilege transition itself is the loudest signal — a role assignment that grants Sysadmin performed by a non-Sysadmin administrative principal. This event should be logged by the product and should be the primary alerting pivot.

Impact Assessment

Kiteworks Core is an enterprise file-sharing and governance platform; a full-privilege compromise of such a system exposes sensitive managed content and the platform's access-control fabric. The blast radius is the entire Kiteworks deployment: all users, all stored/shared files, and all administrative controls are reachable by the newly created Sysadmin account.

CVSS v3.1 subscores and their business meaning:

• Base Score 7.2 (High). Aggregate severity sits in the high band, driven by full compromise of C/I/A once exploited.
• AV:N (Network). The attacker exploits over the network; no physical or adjacent access is required.
• AC:L (Low). No special conditions; exploitation follows normal use of the role-management feature.
• PR:H (High). Requires an authenticated administrative account. This moderates the base score but is not a strong barrier in practice — delegated admin accounts exist to be used, and the entire point of the flaw is that low-tier admins gain high-tier power.
• UI:N (None). No victim interaction required.
• S:U (Unchanged). Impact is confined to the vulnerable component's security authority.
• C:H / I:H / A:H. Complete loss of confidentiality, integrity, and availability across the platform.

Auxiliary risk factors: EPSS is not yet scored, so no probabilistic exploitation-likelihood figure is available (none is fabricated here). CISA KEV does not list this CVE, and no public exploit exists, lowering near-term mass-exploitation probability — but the low complexity and post-auth nature make it attractive for insider misuse and targeted intrusion against high-value collaboration platforms. The patch confidence is 0/4: no vendor fix, workaround, or patch reference was present in any tracked source, so organizations cannot rely on a confirmed fix artifact and must treat the environment as unpatched until they can validate the 9.5.0 upgrade path themselves.

Detection Guidance

Sigma Rule

title: Kiteworks Core Privilege Escalation via Role Assignment (CVE-2026-102093)
id: 7b1c4a92-2f6d-4e8a-9c3b-kiteworks269
status: experimental
description: Detects assignment of full system-administrator privileges by a non-Sysadmin administrative user in Kiteworks Core, consistent with CVE-2026-102093.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102093
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: kiteworks
  service: audit
detection:
  selection_action:
    event.action:
      - 'role_assigned'
      - 'role_assignment'
      - 'user_role_update'
      - 'privilege_grant'
  selection_target:
    target.role|contains:
      - 'Sysadmin'
      - 'System Administrator'
      - 'super_admin'
  filter_authorized:
    actor.role|contains:
      - 'Sysadmin'
      - 'System Administrator'
  condition: selection_action and selection_target and not filter_authorized
falsepositives:
  - Legitimate Sysadmin-initiated role grants if actor role field is not populated
level: high
tags:
  - attack.privilege_escalation
  - attack.t1078
  - cve.2026.102093

YARA Rule

rule CVE_2026_102093_Kiteworks_PrivEsc
{
    meta:
        description = "Detects Kiteworks Core role-assignment privilege escalation artifacts (CVE-2026-102093)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102093"
        date = "2026-01-01"
        severity = "high"

    strings:
        $cve   = "CVE-2026-102093" ascii wide nocase
        $prod  = "Kiteworks" ascii wide nocase
        $role1 = "system-administrator" ascii wide nocase
        $role2 = "Sysadmin" ascii wide nocase
        $role3 = "role-management" ascii wide nocase
        $ver   = "9.5.0" ascii wide nocase

    condition:
        uint16(0) == 0x5A4D or
        (filesize < 10MB and ($cve or ($prod and $ver) or ($role1 and $role3)))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102093 Kiteworks Core Role Assignment Privilege Escalation Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"role"; nocase; http.request_body; content:"Sysadmin"; nocase; http.request_body; content:"administrator"; nocase; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-admin; reference:cve,2026-102093; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-102093; sid:2026102093; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [authentication where event.action == "user_login" and event.outcome == "success"]
  [any where event.category == "iam" and event.action in ("role_assigned", "user_role_update", "privilege_grant")
       and user.target.roles : ("Sysadmin", "System Administrator", "super_admin")]

Splunk SPL Query

index=kiteworks sourcetype=kiteworks:audit
(event.action="role_assigned" OR event.action="role_assignment" OR event.action="user_role_update" OR event.action="privilege_grant")
| eval grantee_role=coalesce(target_role, role_name, assigned_role)
| eval grantor_role=coalesce(actor_role, admin_role, acting_role)
| where match(grantee_role, "(?i)(sysadmin|system.?administrator|super.?admin)")
| where NOT match(grantor_role, "(?i)(sysadmin|system.?administrator)")
| table _time, user, src_ip, grantor_role, grantee_role, target_user
| sort - _time

Wazuh OSSEC Rule

<group name="kiteworks,cve-2026-102093,">
  <rule id="1020930" level="12">
    <decoded_as>json</decoded_as>
    <field name="event.action">role_assigned|role_assignment|user_role_update|privilege_grant</field>
    <field name="target.role">Sysadmin|System Administrator|super_admin</field>
    <description>CVE-2026-102093: Kiteworks Core non-Sysadmin admin granted full system-administrator privileges</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>privilege_escalation,</group>
  </rule>

  <rule id="1020931" level="10">
    <if_sid>1020930</if_sid>
    <field name="actor.role">Sysadmin|System Administrator</field>
    <description>Kiteworks Core legitimate Sysadmin role grant (baseline)</description>
    <group>baseline,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED: no patch evidence, vendor fix, workaround, or patch source was present in any tracked source at time of writing. The only version-level guidance comes from the NVD description, which frames versions before 9.5.0 as vulnerable.

1) Immediate mitigations.

• Review all accounts holding administrative or role-management permissions. Minimize the population of non-Sysadmin administrative users; where such accounts are not strictly required, remove their role-management rights.
• Enforce least privilege on the delegated admin tier: audit which principals can perform role assignments and restrict that capability to the smallest necessary set.
• Compensating control: monitor role-assignment events and alert on any grant of Sysadmin privileges performed by a non-Sysadmin actor (see Detection Guidance). Treat any such event as a security incident.
• Restrict network access to the Kiteworks Core administrative interface using firewall rules, VPN, or IP allowlisting so that only trusted administration networks can reach it. This reduces the exposure surface while validation of the fix path is pending.
• Enforce strong authentication (MFA) on all administrative accounts to reduce the likelihood of credential compromise being chained into this flaw.

2) Patch / upgrade steps.

• Upgrade Kiteworks Core to version 9.5.0 or later, the version threshold indicated by the NVD description. Because no vendor advisory or patch artifact was captured in tracked sources, confirm the fix and the exact target build directly with Kiteworks before relying on the upgrade.
• After upgrading, re-validate the authorization behavior: confirm that a non-Sysadmin administrative user can no longer assign the system-administrator role.
• Audit the account database post-upgrade for any Sysadmin-level accounts that were created or promoted during the vulnerable window; demote or remove any that are not legitimate.

3) Long-term hardening.

• Implement tiered-administration governance: define and enforce an explicit authority ceiling for each administrative role and validate that ceilings are enforced server-side at the point of every privileged mutation.
• Adopt continuous audit logging of all role and privilege changes with immutable retention, and integrate those logs into the SIEM with the detections above.
• Re-audit delegated administrative permissions on a recurring schedule and after every platform upgrade.
• Track CVE-2026-102093 in the vulnerability management program and re-check for an official Kiteworks advisory, CISA KEV addition, and public exploit emergence, since patch confidence may change as vendor data becomes available.

References

1. NVD — CVE-2026-102093: https://nvd.nist.gov/vuln/detail/CVE-2026-102093
2. MITRE CWE-269 — Improper Privilege Management: https://cwe.mitre.org/data/definitions/269.html
3. Kiteworks — product and security advisory portal (vendor advisory for Kiteworks Core): https://www.kiteworks.com/
4. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-102093 not currently listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. FIRST EPSS (no score yet assigned for CVE-2026-102093): https://www.first.org/epss/

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or Nuclei template are associated with CVE-2026-102093 at time of writing.