Read the docs
TI-2026-06320 Aliases CVE-2026-7201GHSA-62q8-jg47-5wpw

Authorization bypass in Progress Sitefinity

Priority MEDIUM 40CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-639.

Summary

CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00348 28th percentileScored 2026-11-07
Fix Fixed Sitefinity (Progress Software): 15.2.8441, 15.3.8531, 15.4.8630

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ProgressSitefinity15.2.8400 to before 15.2.8441; 15.3.8500 to before 15.3.8531; 15.4.8600 to before 15.4.863015.2.8441, 15.3.8531, 15.4.8630Patch availableCNA
  • Sitefinity VendorProgress Affected 15.2.8400 to before 15.2.8441; 15.3.8500 to before 15.3.8531; 15.4.8600 to before 15.4.8630 Fixed in 15.2.8441, 15.3.8531, 15.4.8630 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*15.2.8400 to before 15.2.8441; 15.3.8500 to before 15.3.8531; 15.4.8600 to before 15.4.8630VulnerableProgress
  • cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:* Versions 15.2.8400 to before 15.2.8441; 15.3.8500 to before 15.3.8531; 15.4.8600 to before 15.4.8630 Vulnerable ·Progress

Remediation

  • Fix · CNA Sitefinity (Progress Software) Fixed in 15.2.8441, 15.3.8531, 15.4.8630

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Progress Software Sitefinity — community.progress.com/s/article/Sitefinity-Security-Adviso…

    5 records Highest priority Priority MEDIUM 5 MEDIUM

    Other records, highest priority first

    • TI-2026-06317 Improper access control in Progress SitefinityPriority MEDIUM 49
    • TI-2026-06419 Insufficiently protected credentials in Progress SitefinityPriority MEDIUM 43
    • TI-2026-06420 Insufficiently protected credentials in Progress SitefinityPriority MEDIUM 40
    Show all 5 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-7201
  2. 2026-10-03 Alias added: GHSA-62q8-jg47-5wpw

References

Advisory 1

  • TI-2017-06690 Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and… KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-12346 Progress Sitefinity before 15.0.0 allows XSS by authenticated users via the content form in the SF Editor. CVSS 3.1MEDIUM 6.5
  • TI-2023-13767 An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before… CVSS 3.1CRITICAL 9.8
  • TI-2026-06317 Improper access control in Progress Sitefinity CVSS 3.1CRITICAL 9.8
  • TI-2017-11630 Sitefinity 5.1, 5.2, 5.3, 5.4, 6.x, 7.x, 8.x, 9.x, and 10.x allow remote attackers to… CVSS 3.0CRITICAL 9.8
  • TI-2019-12987 Progress Sitefinity 12.1 has a Weak Password Recovery Mechanism for a Forgotten Password… CVSS 3.1CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences