Kiteworks Core is vulnerable to Improper Input Validation

Kiteworks had a flaw in how it checked user input when managing folder sharing permissions. An attacker could exploit this to give another user higher access levels than intended on a shared folder.

CWE-20 improper input validation in the shared folder role management function allows an authenticated attacker to escalate another user's permissions beyond their intended level. The vulnerability requires access to folder sharing settings and was resolved by implementing stricter input validation in version 9.1.0.