CVE-2026-102149 — Kiteworks Email Protection Gateway Improper Access Control
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with a…
Published: 2026-09-30 · CVSS: 9.4 · CVSS 3.1
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where certificate-based login is enabled, potentially permitting unauthorized access to the account.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7