Vulnerability · Published Sep 30, 2026 · Assigned by cisa-cg
CVE-2026-102139Kiteworks Email Protection Gateway Incorrect Authorization
Medium 6.5
In plain English
A medium-severity authorization bypass via user-controlled key in Email Protection Gateway from Kiteworks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Official description
An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of packages they neither sent nor received.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kiteworks | Email Protection Gateway | 0 – before 9.5.1 |
Weakness: CWE-639, CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N