API Security Controls Bypass in Kiteworks Core

CVE-2026-102134

What is CVE-2026-102134?

The Kiteworks Core platform has a vulnerability that allows authenticated users to bypass critical gateway-level API security controls. This occurs due to inadequate enforcement of session management across specific REST API requests, enabling unauthorized access to functionality that does not adhere to the standard security measures. As a result, users may engage with API functions without having to verify session authenticity, exposing the platform to potential session tampering and unauthorized actions. It is vital for users and administrators to implement recommended security updates and practices to mitigate this exposure.

References