CVE-2026-102122

Executive Summary

CVE-2026-102122 is an improper authorization vulnerability (CWE-863) in Kiteworks, an enterprise secure file sharing and content governance platform. The flaw allows an authenticated user who holds the Manager role on a shared folder to assign themselves or other folder members the Owner role, in a default configuration, because the application fails to correctly enforce which roles a folder manager is permitted to assign. Successful exploitation results in unauthorized privilege escalation within the affected folder scope, with a CVSS v3.1 base score of 4.3 (Low severity) reflecting low integrity impact and no direct confidentiality or availability impact.

Technical Analysis

CVE-2026-102122 is rooted in incorrect authorization enforcement: Kiteworks "did not correctly enforce which roles a shared folder's manager was permitted to assign." Conceptually, the product implements role-based access control (RBAC) over shared folder objects, where roles such as Manager and Owner carry different privilege levels. The vulnerability class is CWE-863 (Incorrect Authorization), meaning the application authenticated the requester and recognized their role, but then failed to validate whether that role was entitled to perform the role-assignment operation being requested.

The specific failure is a missing or inadequate role-assignment constraint. When a user with the Manager role performs a role-granting action on a folder, the backend is expected to restrict the set of assignable roles to those at or below the manager's own privilege level. In a default configuration, this check is absent or ineffective, allowing the Manager to grant the Owner role — a role above their own — either to themselves or to other members of that folder. This is a vertical privilege escalation implemented as a self-service role assignment, not as a memory-safety or injection flaw.

Attack surface characteristics:

• Authentication required: The attacker must be an authenticated user (CVSS PR:L). No user interaction is needed (UI:N) and the vector is network-accessible (AV:N).
• Scope unchanged: The impact is confined to the same security authority (S:U) — escalation is within the folder's permission model rather than escaping the application's authorization boundary entirely.
• Integrity-only impact: The CVSS vector shows I:L with C:N and A:N. The ability to alter folder ownership and role assignments is an integrity violation of access-control metadata. The score does not assert direct exposure of file contents or service disruption, although the downstream consequences of holding Owner rights may exceed what the base vector captures.
• Default configuration dependency: The advisory explicitly qualifies exploitation as occurring "in a default configuration," implying that non-default configurations (for example, restricted role-assignment policies or custom governance settings) may not be affected.

No affected version range, patch reference, OSV package data, PoC, or exploit code is available from tracked sources. All specific code-level details (function names, endpoints, parameter names) beyond the advisory text are unknown and are deliberately not fabricated in this report. The vulnerability is best understood and defended at the authorization-design level: enforcement of role-assignment boundaries on shared folder objects.

Exploitation Scenarios

No public proof-of-concept is available; the attack chain below is inferred from the vulnerability class (CWE-863, role-assignment authorization bypass) and the advisory text, and does not assert unverified implementation specifics.

1. Reconnaissance / target identification. An attacker who already possesses valid low- or mid-tier credentials on a Kiteworks instance identifies shared folders on which their account holds the Manager role. This may be obtained through legitimate collaboration (an employee, contractor, or partner invited to manage a folder), through a compromised low-privilege account, or through credential reuse. Reconnaissance is limited to enumerating folders visible to the authenticated account and confirming the role held on each.

2. Triggering the flaw class. Using the application's normal folder-management interface or API for managing members and roles, the Manager-role user performs a role-assignment operation that grants the Owner role — to their own account or to another member of the folder. Because the application does not correctly enforce which roles a manager may assign in a default configuration, the assignment succeeds instead of being rejected. The request is authenticated and well-formed; no injection, malformed input, or exploit payload is required. The vulnerability is a logic/authorization defect, not a parsing defect.

3. Execution method. At the vulnerability-class level, "execution" is simply the successful completion of an authorization-sensitive action that should have been denied. There is no memory corruption, no code execution payload, and no public exploit tooling. Any technique used is an ordinary, authenticated application request of the same kind the Manager role is legitimately allowed to issue — the abuse is in the target of that operation (a role above the requester's privilege) rather than its format.

4. Post-exploitation impact. Having obtained Owner rights on the folder, the attacker holds the highest role level on that object, which typically governs membership, permissions, and folder-level settings. Integrity of the folder's access-control state is the primary casualty (consistent with I:L in the vector). Depending on the platform's role semantics — which are not specified in the available data — Owner rights may provide a foothold for broader lateral movement, persistence via membership changes, or expanded visibility into shared content. No confirmed confidentiality or availability impact is established by the CVSS vector, and no in-the-wild exploitation is documented.

Impact Assessment

Business impact centers on broken access-control integrity within Kiteworks shared workspaces. An organization relying on Kiteworks for governed content exchange — legal, finance, M&A, HR, or regulated data workflows — assumes that role delegation within a shared folder respects a privilege hierarchy. CVE-2026-102122 undermines that assumption by allowing a Manager to climb to Owner, or to promote a collaborating account to Owner, without authorization.

• Affected systems: Kiteworks deployments running a default configuration in which folder managers can perform role assignments. Exact affected versions are unknown; no version data was available from tracked sources.
• Blast radius: Scoped to individual shared folders, but an attacker with multiple Manager roles can repeat the technique across every folder they manage, compounding exposure. CVSS S:U indicates the escalation does not cross a security-authority boundary (e.g., it does not directly grant host- or operating-system-level access).
• CVSS interpretation: Base 4.3 reflects AV:N / AC:L / PR:L / UI:N / S:U / C:N / I:L / A:N. Attack is easy to perform (AC:L) and needs no victim interaction (UI:N), but requires a valid account (PR:L) and yields only a low integrity effect. The Low severity rating should not be read as "no risk": privileged governance features often carry disproportionate downstream consequence even when the raw vector is modest.
• Regulatory/audit angle: Unauthorized changes to folder ownership and membership can violate least-privilege and segregation-of-duties controls relevant to frameworks such as ISO 27001, SOC 2, and PCI DSS, and can complicate eDiscovery and chain-of-custody for shared content.

Detection Guidance

Detection focuses on authorization-anomaly logging: a user with Manager-level rights causing a role assignment to Owner, or role-change events initiated by accounts that should not be able to grant elevated roles. Because no CVE-specific IoCs exist and no exploit code is public, the following rules target the behavior described in the advisory rather than a fixed payload.

Sigma Rule

title: Kiteworks Unauthorized Owner Role Assignment by Folder Manager (CVE-2026-102122)
id: 9f4c1e2a-7b3d-4a10-9c6e-2d5b8f0a1c33
status: experimental
description: Detects role-assignment events in Kiteworks where a folder Manager grants the Owner role, indicative of CVE-2026-102122 privilege escalation.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102122
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: kiteworks
  service: application
detection:
  selection_event:
    event_type:
      - 'folder_role_assignment'
      - 'role_change'
      - 'member_role_updated'
  selection_roles:
    assigned_role|contains: 'Owner'
  selection_actor:
    actor_role: 'Manager'
  condition: selection_event and selection_roles and selection_actor
falsepositives:
  - Legitimate administrative promotion workflows performed by platform admins
  - Migration or bulk permission synchronization jobs
level: medium
tags:
  - attack.privilege_escalation
  - attack.t1078
  - cve.2026.102122

YARA Rule

rule CVE_2026_102122_Kiteworks_Role_Escalation_Indicators
{
    meta:
        description = "Detects application log or config artifacts referencing unauthorized folder Owner role assignment in Kiteworks (CVE-2026-102122)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102122"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $a = "assigned_role" ascii nocase
        $b = "Owner" ascii wide
        $c = "Manager" ascii wide
        $d = "folder_role_assignment" ascii nocase
        $e = "role_change" ascii nocase

    condition:
        uint32be(0) != 0x504b0304 and
        (
            ($d and $b) or
            ($e and $a and $b and $c)
        )
}

Note: This YARA rule targets textual artifacts in exported logs or configuration files, since the vulnerability has no memory-corruption or file-signature component. It is a hunting aid, not a definitive detector.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102122 Kiteworks Possible Owner Role Assignment by Folder Manager"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"role"; content:"Owner"; nocase; http.header; content:"Authorization"; pcre:"/Owner/i"; classtype:attempted-user; reference:cve,2026-102122; sid:2026102122; rev:1; metadata:created_at 2026_01_01, affected_product Kiteworks;)

Note: The URI and parameter names above are generic indicators chosen for the role-assignment action class ("role", "Owner"); they are not confirmed Kiteworks API paths. Tune content matches to the actual deployment's request schema.

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" ]
  [ any where event.category == "iam" and event.action in ("role_assignment","role_change","member_role_updated")
      and kiteworks.assigned_role == "Owner" and kiteworks.actor_role == "Manager" ]

Splunk SPL Query

index=kiteworks sourcetype=kiteworks:audit
| search (event_type="folder_role_assignment" OR event_type="role_change" OR event_type="member_role_updated")
| search assigned_role="Owner" actor_role="Manager"
| stats count min(_time) as first_seen max(_time) as last_seen by user actor_ip folder_id assigned_role
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="kiteworks,cve-2026-102122,">
  <rule id="102122" level="10">
    <decoded_as>json</decoded_as>
    <field name="event_type">folder_role_assignment|role_change|member_role_updated</field>
    <field name="assigned_role">Owner</field>
    <field name="actor_role">Manager</field>
    <description>CVE-2026-102122: Kiteworks Manager granted Owner role on shared folder (possible privilege escalation)</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>privilege_escalation,access_control,</group>
  </rule>
</group>

Note: Wazuh will only match if the kiteworks audit log is parsed to JSON with the named fields. Adjust event_type, assigned_role, and actor_role field names to match the deployed decoder.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, workaround, or affected-version data was available in the provided intelligence. The guidance below is therefore based on the vulnerability class and must be validated against current vendor communications.

1. Immediate mitigations

   • Audit shared folders for unexpected Owner-role assignments, especially where the promoting account held only the Manager role, and revert any unauthorized membership changes.
   • Where the product permits it, configure non-default role-assignment policies so that folder Managers cannot grant Owner or any role equal to or above their own. The advisory notes default configurations are affected, so non-default hardening policies should be evaluated as a compensating control.
   • Enforce least privilege on role grants: restrict who can hold the Manager role to trusted personnel, and require dual authorization for ownership changes if the platform supports approval workflows.
   • Monitor and alert on all role-change events using the detection content above.

2. Patch / upgrade steps

   • No patch or fixed version has been identified in tracked sources. Monitor the vendor's security advisory channel and NVD entry for CVE-2026-102122 for an official fix.
   • When a fix is released, prioritize upgrade of internet-exposed and business-critical Kiteworks instances, verify the version, and re-test that a Manager-role account can no longer assign Owner.

3. Long-term hardening

   • Institute server-side authorization checks that validate the assignable role set against the requester's own role at the API/persistence layer, not merely in the UI, so that direct API calls cannot bypass constraints.
   • Adopt unit and integration tests for RBAC invariants (no role may grant a role above itself) and include them in CI/CD.
   • Apply periodic access reviews and segregation-of-duties reviews to shared-folder memberships, and centrally log/retain all role-assignment events.

References

• NVD — CVE-2026-102122: https://nvd.nist.gov/vuln/detail/CVE-2026-102122
• Kiteworks security advisories: https://www.kiteworks.com/ (check vendor advisory channel for CVE-2026-102122)
• CWE-863 — Incorrect Authorization: https://cwe.mitre.org/data/definitions/863.html
• FIRST EPSS — no score yet available for CVE-2026-102122 (see https://www.first.org/epss/)
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-102122 not currently listed)

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or Nuclei template were identified in the provided intelligence.