CVE-2026-7201
Analyzed
Analyzed - Analysis Complete
Authorization Bypass in Progress Sitefinity
Publication date: 2026-06-02
Last updated on: 2026-06-04
Assigner: Progress Software Corporation
Description
Description
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| progress | sitefinity | From 15.2.8400 (inc) to 15.2.8441 (exc) |
| progress | sitefinity | From 15.3.8500 (inc) to 15.3.8531 (exc) |
| progress | sitefinity | From 15.4.8600 (inc) to 15.4.8630 (exc) |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-639 | The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. |
