CVE-2026-102149 Kiteworks Email Protection Gateway Improper Access Control
9.4
Analysis on rafaelpfister.ch
- Article · November 6, 2026 Kiteworks EPG 9.5.1: Four publicly documented security fixes Kiteworks Email Protection Gateway 9.5.1 fixes four publicly documented vulnerabilities, including an account takeover issue with a CVSS score of 9.4. Installations prior to 9.5.1 should be updated to this or a later version.
- Article · October 31, 2026 totemomail 9.5.1: Account takeover in the Web Portal and SSRF via incoming email fixed totemomail 9.5.1 fixes eight security vulnerabilities and brings totemomail in line with the Kiteworks advisories for Email Protection Gateway published at the end of September. Two vulnerabilities can be exploited without authentication: a flaw in the Web Portal password reset process that allows administrator accounts to be taken over, and server-side retrieval of URLs from incoming messages. The release also includes path traversal fixes in the Admin API and Mail API, as well as updated Tomcat and Batik libraries.
- Article · September 25, 2026 Kiteworks: Vendor Recommends Shutdown on September 26 – What Is Known So Far Kiteworks asked its customers to shut down all systems on Saturday, September 26, 2026, from 4:00 a.m. to 10:00 a.m. Final report: During the shutdown, the vendor found and closed a critical flaw without a CVE; on September 30, 125 advisories followed, including CVE-2026-54154 (CVSS 10.0) in the Email Protection Gateway. Totemomail is not affected.
Vendor description
Kiteworks Email Protection Gateway did not sufficiently restrict which account a certificate could be assigned to. This could allow an attacker to associate a certificate with another user's account, affecting the confidentiality and integrity of that account's encrypted mail and, where certificate-based login is enabled, potentially permitting unauthorized access to the account. Reference data
- Vendor
- Kiteworks
- Affected products
- Email Protection Gateway
- CVSS 3.1
- 9.4 (CRITICAL)
- Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L- Weakness type
- CWE-306: Missing Authentication
- Published
- September 30, 2026
