CVE-2026-7198: CWE-284: Improper Access Control in web services in Progress Sitefinity

Synopsis

An improper access control vulnerability in the web services component of Progress Sitefinity versions 15.4.8623 through 15.4.8629 allows a remote, unauthenticated attacker to bypass authorization checks entirely. The vulnerability is reachable over the network with no credentials required and no victim interaction needed. Successful exploitation gives the attacker full read, write, and availability control over the affected installation. A patched-image rebuild at version 15.4.8630 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable web services endpoint is exposed over the network, so the attacker must be able to reach the host via HTTP/HTTPS from the internet or an internal network segment.

• AuthenticationNot required

  No credentials of any privilege level are needed; the access control bypass is exploitable by a fully anonymous, unauthenticated request.

• Victim interactionNot required

  The attacker makes direct requests to the service and does not need any user on the target system to open a link, file, or page.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or environmental setup beyond network access to the service.

Blast Radius

• Reads all restricted content managed by Sitefinity, including unpublished pages, media assets, user records, and any data exposed through the web services layer.
• Writes or modifies persisted content, configuration, and data records through the same unauthenticated web services access, allowing an attacker to alter or delete site content and settings.
• Crashes or degrades the Sitefinity installation by abusing service endpoints, denying legitimate users and administrators access to the platform.
• Because all three of confidentiality, integrity, and availability are fully compromised, an attacker can chain read-write access into persistent backdoor setup or full takeover of the application.