Kiteworks Email Protection Gateway saves user sessions even after an account has been disabled, leading to a scenario where blocked users can continue to access the system until the session naturally times out. This weakness, classified as CWE‑613, allows the persistence of unauthorized access, compromising confidentiality and potentially allowing further unauthorized actions within the platform.

Kiteworks Email Protection Gateway by Kiteworks is affected. All releases prior to version 9.2.1 lack the necessary session expiration logic. Users should upgrade to 9.2.1 or later to apply the vendor’s patch and eliminate the bug.

The CVSS base score of 4.9 indicates a limited impact; EPSS is below 1 %, signifying a low likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is inferred to be an authenticated session that remains active after the user is disabled; therefore, an attacker requires an existing, valid session to benefit. This flaw enables continued access by a previously blocked user rather than remote unauthenticated exploitation. While the risk is moderate, timely remediation reduces the window during which unauthorized users can exploit the system.