This vulnerability is a stored XSS (CWE-79) in Kiteworks Core that permits an administrator with limited delegated permissions to store crafted content containing malicious JavaScript. When a System Administrator views the affected page, the script executes in their authenticated session, potentially allowing the attacker to escalate privileges to full administrative control of the tenant. The affected versions are all Kiteworks Core versions from 0 up to but not including 9.5.1. The CVSS 3.1 score is 8.1, indicating high severity. No vendor advisory or patch information is provided in the input data.

An attacker with limited delegated administrative permissions can exploit this vulnerability to execute arbitrary JavaScript in the context of a System Administrator's session. This can lead to privilege escalation, allowing the attacker to gain full administrative control of the tenant, including creating new administrative accounts. This compromises the confidentiality and integrity of the system and its data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict delegated administrative permissions carefully and monitor for suspicious activity related to administrative accounts. Avoid viewing untrusted content in administrative sessions where possible.