CVE-2026-7201

CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.

Score

CVSS 3.1 8.8 High

Status

Analyzed - security@progress.com

Published

2026-06-02

Last modified

2026-06-02

Weaknesses

CWE-639

Affected products

• Sitefinity (Progress)
• Sitefinity (Progress Software)

References

• https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-…