CVE-2026-102115 is a critical security vulnerability in Kiteworks Core affecting versions prior to 9.5.0. The vulnerability arises from improper validation of parameters in the password reset process. An attacker without authentication can exploit this weakness by submitting crafted requests to reset the password of any user with a locally stored password, bypassing the need for the reset link sent via email. Successful exploitation grants the attacker full access to the compromised account, including administrative accounts, leading to complete system compromise.

The vulnerability allows unauthenticated attackers to reset passwords of targeted accounts without access to the legitimate password reset email. This results in full account takeover, including administrative accounts, which can lead to unauthorized access, data breaches, and potential system control. The CVSS v3.1 base score is 9.8, indicating critical severity with network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

No official patch or remediation details are provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the password reset functionality if possible and monitor for suspicious password reset activity. Avoid relying solely on email-based password reset without additional validation controls.