{"id":"CVE-2026-29092","state":"PUBLISHED","title":"Kiteworks Email Protection Gateway has an Insufficient Session Expiration","description":"Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked users to maintain active sessions after their account is disabled. This could allow unauthorized access to continue until the session naturally expires. Upgrade Kiteworks to version 9.2.1 or later to receive a patch.","publishedAt":"2026-03-25T16:59:55.033Z","updatedAt":"2026-03-25T17:29:41.481Z","severity":{"score":4.9,"label":"Medium","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","source":"GitHub_M"},"assigner":"GitHub_M","products":["kiteworks Kiteworks Email Protection Gateway"],"affected":[{"vendor":"kiteworks","product":"Kiteworks Email Protection Gateway","versions":[{"version":"< 9.2.1","status":"affected"}]}],"references":["https://github.com/kiteworks/security-advisories/security/advisories/GHSA-92w7-fpjr-wpxc"],"weaknesses":["CWE-613"],"ingestedAt":"2026-10-29T20:11:31.369Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/29xxx/CVE-2026-29092.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-29092","state":"PUBLISHED","datePublished":"2026-03-25T16:59:55.033Z","dateUpdated":"2026-03-25T17:29:41.481Z","assignerShortName":"GitHub_M","assignerOrgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateReserved":"2026-03-03T21:54:06.707Z"},"containers":{"cna":{"title":"Kiteworks Email Protection Gateway has an Insufficient Session Expiration","descriptions":[{"lang":"en","value":"Kiteworks is a private data network (PDN). Prior to version 9.2.1, a vulnerability in Kiteworks Email Protection Gateway session management allows blocked users to maintain active sessions after their account is disabled. This could allow unauthorized access to continue until the session naturally expires. Upgrade Kiteworks to version 9.2.1 or later to receive a patch."}],"affected":[{"vendor":"kiteworks","product":"Kiteworks Email Protection Gateway","versions":[{"version":"< 9.2.1","status":"affected"}]}],"references":[{"url":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-92w7-fpjr-wpxc","name":"https://github.com/kiteworks/security-advisories/security/advisories/GHSA-92w7-fpjr-wpxc","tags":["x_refsource_CONFIRM"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":4.9,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","version":"3.1"}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-613","lang":"en","description":"CWE-613: Insufficient Session Expiration","type":"CWE"}]}],"providerMetadata":{"shortName":"GitHub_M","orgId":"a0819718-46f1-4df5-94e2-005712e83aaa","dateUpdated":"2026-03-25T16:59:55.033Z"},"source":{"advisory":"GHSA-92w7-fpjr-wpxc","discovery":"UNKNOWN"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2026-03-25T17:29:30.459619Z","id":"CVE-2026-29092","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-03-25T17:29:41.481Z"}}]}}}