What is the CVSS score of CVE-2026-7201?

CVE-2026-7201 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Progress Sitefinity are affected by CVE-2026-7201?

Progress Sitefinity versions 15.2.x through 15.4.x contain a critical authorization bypass vulnerability (CVE-2026-7201, CVSS 8.8) enabling account takeover: low-privileged users can modify…. A patch is available.

How to fix or mitigate CVE-2026-7201?

24 hours: Identify all systems running Sitefinity 15.2.x-15.4.x; review account modification logs for unauthorized changes; enable verbose logging on user account property modifications. 7 days: Deploy API gateway or WAF rules to restrict user identifier modification requests; implement real-time alerting on account changes from non-administrative users. 30 days: Establish upgrade timeline to unaffected Sitefinity version; monitor vendor communications for emergency patches or mitigations.

Progress Sitefinity CVE-2026-7201

EUVD-2026-33920 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-06-02 security@progress.com

GHSA-62q8-jg47-5wpw

Authentication Bypass Sitefinity

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 02, 2026 - 16:01 EUVD

Analysis Generated

Jun 02, 2026 - 14:32 vuln.today

DescriptionCVE.org

CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.

AnalysisAI

Authenticated account takeover in Progress Sitefinity 15.2.x, 15.3.x, and 15.4.x allows a low-privileged remote user to modify account properties belonging to other users - including potentially higher-privileged accounts - by manipulating user-controlled identifiers in web service requests. The flaw is an IDOR-style authorization bypass (CWE-639) and, while no public exploit has been identified at time of analysis, the 8.8 CVSS rating reflects realistic escalation to account compromise once a foothold exists. No vendor-released patch data, KEV listing, or EPSS score was supplied with this advisory.

Technical ContextAI

Progress Sitefinity is a .NET-based digital experience and web content management platform commonly deployed for enterprise marketing sites, intranets, and customer portals. The vulnerability is rooted in CWE-639 (Authorization Bypass Through User-Controlled Key), an Insecure Direct Object Reference pattern in which a backend web service trusts a client-supplied identifier (such as a user ID, GUID, or account key) to determine which record to operate on, without enforcing that the requesting principal owns or has rights over that record. In Sitefinity's case, one or more account-management web service endpoints accept attacker-controlled keys and apply property modifications without performing a proper ownership or role check, so authenticated low-privileged sessions can reach data scoped to other identities.

RemediationAI

Upgrade to Sitefinity 15.2.8441, 15.3.8531, or 15.4.8630 (or later) on the corresponding branch, per the Progress May 2026 security advisory at https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026. Where immediate patching is not possible, restrict the affected account-management web service endpoints at the reverse proxy or WAF layer so that they are reachable only from trusted administrative networks - this will break legitimate self-service profile flows for end users and should be coupled with monitoring of authenticated requests for anomalous user-identifier parameters and out-of-pattern profile modifications. Disabling or tightening self-registration reduces the pool of authenticated attackers who can attempt the bypass, at the cost of friction for new customer signups. Rotate credentials and review audit logs for unexpected profile changes on any instance that may have been exposed before patching.