CVE-2025-53900: medium-severity vulnerability in kiteworks security-advisories
Kiteworks MFT has a Privilege Defined With Unsafe Actions
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Kiteworks MFT has a flaw in how it defines user roles and permissions for managing file transfer connections. Authorized users could gain more access rights than intended, leading to privilege escalation.
CWE-267 involves improper privilege definition in role-based access control. An authenticated attacker with standard user privileges could escalate permissions by exploiting misconfigured roles in the Connections management module, potentially gaining administrative-level access to file transfer workflows and sensitive operations.
In the same product, most dangerous first.