CVE-2026-7198

The access control mechanism in Progress Sitefinity web services does not properly verify the requester's identity, allowing an attacker to bypass required authentication. An attacker can send requests to protected endpoints (web services) directly over the network without providing any credentials. The lack of authentication requirement (CVSS PR:N, UI:N) means that the attack does not require user interaction or possession of an account in the system.

The attacker gains full access to content and functionality that should be protected, resulting in a complete breach of confidentiality, integrity, and availability of the installed system. In practice, this may mean reading, modifying, or deleting data, as well as potential takeover of the Sitefinity installation.

Progress Sitefinity should be updated to version 15.4.8630 or newer. Detailed instructions are available in the official Progress security bulletin provided in the manufacturer's references.

Progress Sitefinity in versions 15.4.8623 to 15.4.8629 (before version 15.4.8630)