CVE-2026-7201: CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity

Synopsis

An authorization bypass through user-controlled key (IDOR-class vulnerability) affects Progress Sitefinity versions 15.2.x, 15.3.x, and 15.4.x before their respective patch releases. The flaw is reachable over the network and requires only a low-privilege authenticated account, meaning any registered user may be able to tamper with account properties belonging to other users. Successful exploitation enables an attacker to modify other accounts in ways that can lead to full account compromise. Patched-image rebuilds at versions 15.2.8441, 15.3.8531, and 15.4.8630 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable web service endpoint is exposed over the network, so an attacker must be able to reach the Sitefinity instance via HTTP/HTTPS.

• AuthenticationRequired

  A low-privilege authenticated account is sufficient; any registered user credential meets this requirement.

• Victim interactionNot required

  No action by another user or administrator is needed to trigger the vulnerability.

• Attack complexityDetail

  Exploitation is described as reliable and condition-free at the network level, though the CVE notes that the attacker must know certain key values not generally visible to low-privileged users, adding a modest reconnaissance step.

Blast Radius

• Attacker modifies account properties (such as email address, username, or role assignments) of arbitrary other users.
• Modified account properties can be leveraged to take over targeted user accounts, including accounts with elevated privileges.
• Confidential user profile data exposed during the account-property lookup may be read as part of the exploit chain.
• Integrity of user records in the Sitefinity database is compromised, potentially affecting downstream access controls and audit trails.