CVE-2025-53900CWE-267

CVE-2025-53900

Medium · published November 29, 2025

CVSS v3.1
6.5
EPSS
1%
Percentile
66.3
In the wild
Unconfirmed
What it is

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This issue has been patched in version 9.1.0.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.01138 · 66.3th percentile
Weakness
CWE-267 · Privilege Defined With Unsafe Actions
Published
2025-11-29T08:15Z
Affected products (1)
ProductVersionsFixed in
accellion/kiteworks_managed_file_transfer< 9.1.09.1.0
References (1)
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-gjq3-8v6p-2h6h · [email protected]
EPSS history
Timeline
  • 29 NOV 02:25Z
    Kiteworks MFT has a Privilege Defined With Unsafe Actions
    cvelistv5