CVE-2025-53900

MEDIUM

Kiteworks MFT has a Privilege Defined With Unsafe Actions

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-53900 has a selected CVSS score of 6.5 (medium).

Description

Kiteworks MFT orchestrates end-to-end file transfer workflows. Prior to version 9.1.0, an unfavourable definition of roles and permissions in Kiteworks MFT on managing Connections could lead to unexpected escalation of privileges for authorized users. This issue has been patched in version 9.1.0.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 1, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

security-advisories

Browse kiteworks / security-advisories
CVE List< 9.1.0affected

References

1