CVE-2026-102139CWE-639CWE-863broken-access-control

CVE-2026-102139

Medium · published October 1, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
32.5
In the wild
Unconfirmed
What it is

An authorization check in the large file exchange feature of Kiteworks Email Protection Gateway did not correctly establish that the requesting user was a party to the package being requested. An authenticated user of that optional feature could read the subject, message body, and attachments of packages they neither sent nor received.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00394 · 32.5th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-863 · Incorrect Authorization
Published
2026-10-01T01:17Z
Affected products (1)
ProductVersionsFixed in
accellion/kiteworks< 9.5.19.5.1
References (2)
https://github.com/kiteworks/security-advisories/security/advisories/GHSA-fp46-xhg8-vpgm · 9119a7d8-5eab-497f-8521-727c672e3725https://raw.githubusercontent.com/cisagov/CSAF/develop/csaf_files/VA/white/2026/va-26-274-01.json · 9119a7d8-5eab-497f-8521-727c672e3725
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 20:11Z
    Kiteworks Email Protection Gateway Incorrect Authorization
    cvelistv5