CVE-2026-7198
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Progress Sitefinity 15.4.8623 before version 15.4.8630 has an improper access control vulnerability. A remote unauthenticated attacker can access restricted content, leading to full compromise of confidentiality, integrity, and availability.
Risk Assessment
An attacker can gain full access to protected content and Sitefinity functionality, potentially leading to data leakage and takeover of the installation.
Recommendation
Upgrade Sitefinity to version 15.4.8630 or later.
Other vulnerabilities in Progress Sitefinity
See all- CVE-2026-7312Critical
Progress Sitefinity in multiple versions (14.0.7700-14.4.8152, 15.0.8200-15.0.8234, 15.1.8300-15.1.8335, 15.2.8400-15.2.8441, 15.3.8500-15.3.8531, 15.4.8600-15.4.8630) has a vulnerability due to insufficiently protected credentials. A remote unauthenticated attacker can obtain plain-text credentials used to connect to the Sitefinity Insight service.
- CVE-2026-7313High
CWE-522: Insufficiently Protected Credentials in web services in Progress Sitefinity versions 8.0.5700 to 13.3.7652. A remote authenticated attacker can obtain plain-text credentials used to connect to the Sitefinity Insight service. Requires active integration with Sitefinity Insight, non-default site configuration, and valid back-end authorization.
- CVE-2026-7201High
In Progress Sitefinity versions 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630, an authorization bypass vulnerability via user-controlled key exists. A remote authenticated attacker can modify account properties of other users.
- CVE-2026-7195High
Progress Sitefinity versions 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 have an improper input validation vulnerability (CWE-20) in web services. A remote unauthenticated attacker can compromise user account integrity and confidentiality. User interaction and non-default site configuration are required.
Original NVD description (English source)
CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS