CVE-2026-102107

Executive Summary

CVE-2026-102107 is a business logic flaw (CWE-639: Authorization Bypass Through User-Controlled Key) in the Kiteworks Core file-request feature. An authenticated user with the feature enabled on their profile can craft a file request that appears to originate from a different user account, because the server fails to verify that the requester is authorized to act on behalf of the specified account. Successful exploitation requires the targeted recipient to act on the request, enabling social-engineering-based file or information disclosure under a trusted identity. The vulnerability is currently unpatched and carries a CVSS 3.1 base score of 4.6, reflecting limited confidentiality and integrity impact and a requirement for user interaction.

Technical Analysis

The vulnerability resides in the file-request functionality of Kiteworks Core, a managed file transfer and content collaboration platform. At its core, the flaw is a horizontal authorization bypass: the server accepts a request that specifies a sending identity but does not validate that the authenticated principal has the right to impersonate or act as that identity. This maps directly to CWE-639 (Authorization Bypass Through User-Controlled Key), where a user-controlled identifier—in this case the apparent originator of a file request—is trusted without an accompanying authorization check.

The attack surface is the file-request feature, which must be enabled on the attacker's profile. The attacker needs a valid, authenticated session (PR:L). The malicious request must be delivered to and acted upon by the target recipient (UI:R), which caps the practical exploitability. The NVD description does not specify the exact parameter name, endpoint, or API path involved; no function names, routes, or request fields are provided, so the precise implementation detail is unknown. What is derivable from the description is the trust model failure: the server binds the displayed sender identity to a client-supplied value rather than to the authenticated session context, and performs no ownership or delegation check.

Because the verification step is missing entirely, the exploitation primitive is spoofed identity within the application's own trusted workflow. The request is not forged at the network layer (no SMTP header injection, no email spoofing); it is generated legitimately by the platform and therefore carries the platform's authenticity signals, which is what makes it effective as a phishing and data-solicitation vector. The impact is limited in scope—C:L/I:L, A:N—consistent with an abuse of an internal feature rather than remote code execution or privilege escalation to administrative control. No public PoC, exploit code, or Nuclei template exists, and no affected version range has been published, meaning defenders cannot currently enumerate vulnerable builds from vendor data.

Exploitation Scenarios

The following chain is inferred from the vulnerability class (CWE-639) and the NVD description. No public PoC is available; no specific parameter or endpoint names are asserted because none were disclosed.

1. Reconnaissance / target identification: The attacker obtains an authenticated account on a Kiteworks instance where the file-request feature is enabled for their profile. They identify a target recipient—an external partner, customer, or colleague—who is likely to trust a particular internal identity, such as a finance lead, executive, or IT administrator. Enumeration may rely on directory information visible within the platform or on external OSINT.

2. Triggering the flaw: The attacker initiates a file request through the normal feature workflow but supplies the identity of a different user account as the apparent originator. Because the server does not verify that the requester is authorized to act as the specified account, the request is accepted and generated with the impersonated identity attached. This is the authorization bypass: a user-controlled value (the sender identity) is trusted without an ownership or delegation check.

3. Delivery and execution: The request is delivered to the target recipient through the platform's standard notification or sharing mechanism. The recipient, seeing a request that appears to come from a trusted internal party, acts on it—uploading files, responding with information, or clicking through. Exploitation therefore depends on recipient behavior; the vulnerability provides the credibility of a spoofed trusted identity, not automated compromise.

4. Post-exploitation impact: The attacker receives any files or information the recipient submits, potentially including sensitive documents, credentials, or business data. Because the request appears to originate from another legitimate user, the true source is obscured and the impersonated party may be implicated in internal investigations. The scope remains confined to the file-request workflow (S:U, C:L/I:L), but the reputational and social-engineering value can exceed the technical severity score.

Impact Assessment

Business impact is primarily confidentiality and social-engineering driven. An attacker can solicit sensitive files or information from a recipient by impersonating a trusted internal identity, which undermines the integrity of the platform's request workflow (I:L) and may expose confidential content (C:L). There is no availability impact (A:N), and the scope is unchanged (S:U), meaning only the vulnerable component is affected and no privilege boundary is crossed beyond the impersonated identity.

Affected systems are Kiteworks Core deployments where the file-request feature is enabled for standard authenticated users. The blast radius depends on directory visibility and the recipient's willingness to comply—attackers can target multiple recipients across an organization, turning a low-severity technical flaw into a scalable phishing campaign. CVSS subscores reflect that: attack vector network (AV:N) and low complexity (AC:L) make it easy to attempt, but privileges required (PR:L) and user interaction (UI:R) limit who can exploit it and how reliably. No CISA KEV listing, no EPSS score, and no in-the-wild evidence indicate that exploitation is currently observed or likely imminent, though the low technical barrier means defenders should not dismiss it.

Detection Guidance

Sigma Rule

title: Kiteworks File Request Identity Spoofing (CWE-639)
id: 8f4c2a91-3d7b-4e21-9a55-1c6e0b7f2d10
status: experimental
description: Detects file-request creation events where the claimed sender identity differs from the authenticated session user in Kiteworks Core.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102107
author: valtersit.com
date: 2026-01-01
logsource:
  product: kiteworks
  service: audit
detection:
  selection:
    event_type: 'file_request_created'
  filter_sender_mismatch:
    claimed_sender_id|field: actor_id
  condition: selection and not filter_sender_mismatch
fields:
  - actor_id
  - claimed_sender_id
  - recipient
  - request_id
falsepositives:
  - Legitimate delegated file-request workflows
  - Administrative impersonation features with proper auditing
level: medium

YARA Rule

rule CVE_2026_102107_Kiteworks_FileRequest_Identity_Spoof
{
    meta:
        description = "Detects artifacts referencing Kiteworks file-request sender spoofing indicators"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102107"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $kr = "Kiteworks" nocase
        $fr1 = "file_request" nocase
        $fr2 = "file-request" nocase
        $snd = "sender_id" nocase
        $act = "actor_id" nocase
    condition:
        $kr and ($fr1 or $fr2) and ($snd or $act)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102107 Kiteworks file-request sender spoof attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"file"; nocase; content:"request"; nocase; http.header; content:"Content-Type|3a| application/json"; nocase; pcre:"/(file[_-]?request)/i"; threshold:type limit, track by_src, count 5, seconds 60; classtype:attempted-user; sid:2026102107; rev:1;)

Elastic Detection

sequence by user.name with maxspan=30s
  [authentication where event.outcome == "success" and user.name != null]
  [any where event.action == "file_request_created" and kiteworks.claimed_sender != user.name]

Splunk SPL Query

index=kiteworks sourcetype=kiteworks:audit event_type=file_request_created
| where claimed_sender_id != actor_id
| stats count values(claimed_sender_id) as claimed_sender values(recipient) as recipients by actor_id src_ip
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="kiteworks,cve-2026-102107,">
  <rule id="102107" level="8">
    <decoded_as>json</decoded_as>
    <field name="event_type">^file_request_created$</field>
    <field name="claimed_sender_id">\.+</field>
    <field name="actor_id">\.+</field>
    <description>CVE-2026-102107: Kiteworks file-request sender identity mismatch - possible identity spoofing attempt</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: UNPATCHED. No vendor fix, workaround, or affected version range has been published from any tracked source, and no OSV package data is available. The following guidance is generic until vendor information emerges.

1. Immediate mitigations:

   • Disable the file-request feature for all profiles where it is not operationally required; the NVD description confirms exploitation requires the feature to be enabled for the attacker's profile.
   • Restrict feature activation to trusted, vetted accounts and apply least-privilege principles to directory visibility, limiting the number of internal identities an attacker could impersonate credibly.
   • Educate users that file requests should be verified out-of-band with the purported sender before uploading sensitive content, since the flaw relies on recipient action.
   • Monitor audit logs for file-request creation events where the claimed sender differs from the authenticated session user.

2. Patch/upgrade steps:

   • No patch is currently available. Monitor the Kiteworks security advisory channel and the NVD entry for CVE-2026-102107 for version and fix announcements.
   • When a fix is released, validate that it enforces authorization checks binding the request originator to the authenticated principal, and that delegated file-request use cases are explicitly permitted rather than implicitly trusted.

3. Long-term hardening:

   • Enforce server-side authorization on all user-controlled identifiers (CWE-639 remediation): never trust client-supplied sender or account values without an ownership/delegation check.
   • Implement audit trails and anomaly detection for identity-spoofing patterns within internal request workflows.
   • Periodically review feature enablement across profiles and retire unused collaboration features to reduce attack surface.

References

• NVD — CVE-2026-102107: https://nvd.nist.gov/vuln/detail/CVE-2026-102107
• CWE-639 — Authorization Bypass Through User-Controlled Key: https://cwe.mitre.org/data/definitions/639.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Kiteworks Security Advisories: https://www.kiteworks.com/security-advisories/
• FIRST EPSS (currently unscored for this CVE): https://www.first.org/epss/

No threat actor campaigns or in-the-wild exploitation have been reported for this CVE. No public PoC, exploit code, or Nuclei template exists as of this writing.