CVE-2026-7195: CWE-20: Improper Input Validation in web services in Progress Sitefinity

Synopsis

Improper input validation in the web services layer of Progress Sitefinity allows a remote, unauthenticated attacker to compromise user account integrity and confidentiality. The vulnerability is reachable over the network and requires a victim to interact with attacker-controlled content, along with a non-default site configuration. Successful exploitation gives an attacker read and write access to user account data. Patched-image rebuilds at versions 14.4.8152, 15.0.8234, 15.1.8335, 15.2.8441, and 14.4.0 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Sitefinity web services endpoint over the network; the service must be externally or internally accessible to initiate the attack.

• AuthenticationNot required

  No credentials or account are needed; the attacker can interact with the vulnerable endpoint as an anonymous user.

• Victim interactionRequired

  A user must interact with attacker-controlled content (for example, visiting a crafted link or page) for the attack to succeed.

• Attack complexityDetail

  Exploit conditions are low-complexity and reliable once the non-default site configuration requirement is met, with no race conditions or environmental factors required.

Blast Radius

• Reads stored user account data including credentials, session tokens, or profile information.
• Modifies user account records, enabling account takeover or privilege escalation within Sitefinity.
• Compromises the confidentiality of any data scoped to affected user accounts in the CMS.
• Integrity of user-controlled content and access controls within the Sitefinity site may be altered by the attacker.