CVE-2026-102129

Executive Summary

CVE-2026-102129 is a privilege-escalation vulnerability in the user-provisioning interface of Kiteworks Core, caused by a failure to verify that a requesting administrator is entitled to grant the specific role being assigned (CWE-266). An administrator holding delegated permissions limited to role changes can exploit this to elevate an account to full system-administrator privileges. With a CVSS base score of 7.2, successful exploitation yields high confidentiality, integrity, and availability impact across the affected platform.

Technical Analysis

The vulnerability class is CWE-266 ("Incorrect Privilege Assignment"), which occurs when a system performs a privilege or role assignment without adequately validating that the acting principal holds authority to confer that privilege. The NVD description states that the user-provisioning interface in Kiteworks Core "did not verify that the requesting administrator was entitled to grant the role being assigned." The relevant attack surface is the administrative user-provisioning function that assigns roles to accounts.

The specific weakness is an authorization-check gap: the interface enforced, at least in part, that a caller could perform role changes, but did not constrain which roles the caller was permitted to grant. Consequently, an administrator with delegated permissions scoped to "role changes alone" could assign roles outside their delegation boundary — up to and including full system-administrator. This is an instance of privilege boundary violation rather than memory corruption or injection, and the attack requires prior possession of a valid, authenticated administrative context (AV:N, PR:H).

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates network-reachable exploitation with low complexity, requiring high privileges, no user interaction, no scope change, and high impact on all three CIA properties. The exact API endpoints, parameter names, or code paths involved are not disclosed in the available data; the mechanism is understood at the vulnerability-class level (missing entitlement validation on role assignment). No public advisory, patch, or affected-version list has been published by the vendor per tracked sources.

Exploitation Scenarios

No public PoC is available; the attack chain described below is inferred from the vulnerability class (CWE-266, incorrect privilege assignment) and the NVD description, and does not assert undocumented implementation details.

1. Reconnaissance / target identification. An adversary with an existing low- or mid-tier administrative account on a Kiteworks Core deployment — one that has been delegated permissions covering role changes but not full administrative authority — identifies the user-provisioning/role-assignment interface as a target. Reconnaissance is conducted from an authenticated administrative context over the network (AV:N).

2. Triggering the flaw class. The attacker reaches the user-provisioning interface and performs a role assignment. Because the interface verifies only that the caller can perform role changes and does not verify the caller is entitled to grant the specific role requested, the authorization check fails to block the out-of-delegation role grant. The precondition is a valid administrative session with delegated role-change rights (PR:H); no user interaction is required (UI:N).

3. Payload / execution method (class level). The "payload" here is the role-assignment request itself, submitted with a target account and a privileged role value the caller is not entitled to confer. The vulnerability is exploited through the legitimate administrative workflow, not through memory corruption or injected code. No specific endpoint or parameter names are documented in the available data.

4. Post-exploitation impact. The attacker raises a controlled account — their own or an accomplice's — to full system-administrator privileges. This grants the attacker the full authority of the highest-privileged role, enabling configuration changes, access to data managed by the platform, and further account manipulation (C:H/I:H/A:H). Because the elevation is achieved through the provisioning interface and resembles legitimate administrative activity, it may be difficult to distinguish from normal workflow unless role-change auditing is monitored.

Impact Assessment

The blast radius is scoped to the affected Kiteworks Core deployment: once an attacker escalates an account to full system administrator, they gain the highest level of control the product offers. Business impact is severe for organizations relying on Kiteworks Core for secure file sharing and governance of sensitive content, because full administrative control can lead to broad data exposure, integrity compromise of hosted content and configurations, and availability disruption. The CVSS subscores — high Confidentiality, Integrity, and Availability impacts (C:H/I:H/A:H) — reflect that a successful takeover of the top role can affect all protected assets. Scope is unchanged (S:U), and exploitation requires a pre-existing high-privilege foothold (PR:H), lowering the applicable attacker population but raising consequences for insiders or compromised delegated admins. EPSS is not yet scored by FIRST.org; no evidence of exploit-in-the-wild or CISA KEV listing exists in the provided data.

Detection Guidance

Sigma Rule

title: Kiteworks Core Delegated Admin Privilege Escalation via Role Assignment
id: 3f9a2c71-8b64-4d2e-9c15-k1tew0rk0001
status: experimental
description: Detects role-assignment activity in Kiteworks Core user provisioning that may indicate an over-delegated administrator elevating an account to system administrator (CVE-2026-102129, CWE-266).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-102129
author: valtersit.com Threat Intelligence
date: 2026/01/01
logsource:
  product: kiteworks
  service: audit
detection:
  selection_event:
    event.action:
      - role_assign
      - role_change
      - update_user_role
      - assign_role
  selection_role:
    target.role|contains:
      - system administrator
      - sysadmin
      - administrator
  condition: selection_event and selection_role
falsepositives:
  - Legitimate full administrators assigning roles
level: high
tags:
  - attack.t1078
  - cve.2026.102129

YARA Rule

rule CVE_2026_102129_Kiteworks_Role_Escalation
{
    meta:
        description = "Detects HTTP request bodies referencing privileged role assignment to the Kiteworks Core user provisioning interface (CVE-2026-102129)"
        author = "valtersit.com Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-102129"
        date = "2026-01-01"
        severity = "high"

    strings:
        $p1 = "system administrator" nocase
        $p2 = "sysadmin" nocase
        $p3 = "assign_role" nocase
        $p4 = "role" nocase
        $provision = "provision" nocase

    condition:
        ($provision and $p4 and ($p1 or $p2)) or ($p3 and ($p1 or $p2))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-102129 Possible Kiteworks Core Privileged Role Assignment"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"user"; nocase; http.request_body; content:"role"; nocase; http.request_body; content:"system"; nocase; http.request_body; content:"administrator"; nocase; classtype:attempted-admin; reference:cve,2026-102129; sid:2026102129; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" and user.name != null ]
  [ any where event.action in ("role_assign", "role_change", "update_user_role", "assign_role")
      and target.role like~ ("*administrator*", "*sysadmin*") ]

Splunk SPL Query

index=kiteworks sourcetype=kiteworks:audit (action=role_assign OR action=role_change OR action=update_user_role OR action=assign_role)
| search target_role IN ("system administrator","sysadmin","administrator") OR target_role="*administrator*"
| stats count min(_time) as first_seen max(_time) as last_seen values(target_user) as elevated_accounts values(target_role) as roles by actor_user, src_ip
| where count >= 1
| sort - count

Wazuh OSSEC Rule

<group name="kiteworks,cve-2026-102129,">
  <rule id="102129" level="12">
    <decoded_as>json</decoded_as>
    <field name="action">role_assign|role_change|update_user_role|assign_role</field>
    <field name="target_role">system administrator|sysadmin|administrator</field>
    <description>CVE-2026-102129: Kiteworks Core privileged role assignment - possible delegated-admin privilege escalation</description>
    <mitre>
      <id>T1078</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations. Restrict and review all delegated administrative permissions on the Kiteworks Core user-provisioning interface. Where the product allows it, revoke role-change delegation from any administrator who does not require it, and ensure no role-change delegation can confer system-administrator. Apply least privilege to all administrative accounts and enforce separation of duties so that no single delegated admin can both alter roles and reach the top privilege tier. Closely audit and alert on role assignments targeting system-administrator.
2. Patch/upgrade steps. No vendor patch, fixed version, or workaround is documented in tracked sources. Monitor the vendor's security advisory channel and NVD for an updated fixed release; do not assume any current version is remediated. Upon release, validate the version string and RBAC fix before deploying.
3. Long-term hardening. Implement server-side entitlement checks that validate the actor is permitted to grant the specific role requested (not merely that they can perform role changes), and add defense-in-depth so that assignment of the highest role requires independent authorization. Adopt continuous RBAC review, log all provisioning events to a SIEM with the detection rules above, and test role-assignment authorization during routine access reviews and red-team exercises.

References

• NVD — CVE-2026-102129: https://nvd.nist.gov/vuln/detail/CVE-2026-102129
• Kiteworks vendor security advisories: https://www.kiteworks.com (monitor for a product security advisory referencing this CVE)
• CWE-266 — Incorrect Privilege Assignment: https://cwe.mitre.org/data/definitions/266.html
• MITRE ATT&CK T1078 — Valid Accounts: https://attack.mitre.org/techniques/T1078/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (not currently listed for this CVE)

No threat actor campaign or exploit-in-the-wild evidence is available for CVE-2026-102129 in the provided data; no public PoC, Nuclei template, or exploit code has been observed.