CVE-2025-53939: medium-severity vulnerability in kiteworks security-advisories
Kiteworks Core is vulnerable to Improper Input Validation
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Kiteworks had a flaw in how it checked user input when managing folder sharing permissions. An attacker could exploit this to give another user higher access levels than intended on a shared folder.
CWE-20 improper input validation in the shared folder role management function allows an authenticated attacker to escalate another user's permissions beyond their intended level. The vulnerability requires access to folder sharing settings and was resolved by implementing stricter input validation in version 9.1.0.
In the same product, most dangerous first.