Kiteworks Core contains an incorrect authorization vulnerability (CWE-863) where an authenticated user with the Manager role on a shared folder can escalate privileges by assigning the Owner role to themselves or other folder members. This flaw arises from improper enforcement of role assignment restrictions. The issue affects all versions from initial releases up to but not including 9.5.1. The vulnerability has a CVSS 3.1 base score of 4.3, reflecting low complexity and network attack vector but limited impact confined to integrity. No vendor advisory or patch details are available, and no exploits are known in the wild.

An authenticated user with Manager role privileges on a shared folder can elevate their permissions or those of other users to Owner, potentially allowing unauthorized administrative control over the folder. This could lead to unauthorized changes or management actions within the folder. The impact is limited to integrity and does not affect confidentiality or availability according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Manager role assignments carefully and monitor role changes within shared folders to detect potential unauthorized privilege escalations.