Kiteworks MFT has a Privilege Defined With Unsafe Actions

Kiteworks MFT has a flaw in how it defines user roles and permissions for managing file transfer connections. Authorized users could gain more access rights than intended, leading to privilege escalation.

CWE-267 involves improper privilege definition in role-based access control. An authenticated attacker with standard user privileges could escalate permissions by exploiting misconfigured roles in the Connections management module, potentially gaining administrative-level access to file transfer workflows and sensitive operations.