CVE-2026-7201

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7201", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2026-04-27T13:52:28.344Z", "datePublished": "2026-06-02T13:07:36.875Z", "dateUpdated": "2026-06-02T15:12:26.494Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-06-02T13:07:36.875Z"}, "title": "CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21: Exploitation of Trusted Identifiers"}]}], "affected": [{"vendor": "Progress Software", "product": "Sitefinity", "versions": [{"status": "affected", "version": "15.2.8400", "lessThan": "15.2.8441", "versionType": "custom"}, {"status": "affected", "version": "15.3.8500", "lessThan": "15.3.8531", "versionType": "custom"}, {"status": "affected", "version": "15.4.8600", "lessThan": "15.4.8630", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users."}]}], "references": [{"url": "https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026", "tags": ["vendor-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "source": {"discovery": "INTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-02T15:12:20.415939Z", "id": "CVE-2026-7201", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T15:12:26.494Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7201", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-06-02T15:12:20.415939Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-02T15:12:23.482Z"}}], "cna": {"title": "CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity", "source": {"discovery": "INTERNAL"}, "impacts": [{"capecId": "CAPEC-21", "descriptions": [{"lang": "en", "value": "CAPEC-21: Exploitation of Trusted Identifiers"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software", "product": "Sitefinity", "versions": [{"status": "affected", "version": "15.2.8400", "lessThan": "15.2.8441", "versionType": "custom"}, {"status": "affected", "version": "15.3.8500", "lessThan": "15.3.8531", "versionType": "custom"}, {"status": "affected", "version": "15.4.8600", "lessThan": "15.4.8630", "versionType": "custom"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.", "supportingMedia": [{"type": "text/html", "value": "CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2026-06-02T13:07:36.875Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7201", "state": "PUBLISHED", "dateUpdated": "2026-06-02T15:12:26.494Z", "dateReserved": "2026-04-27T13:52:28.344Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2026-06-02T13:07:36.875Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Sitefinity", "vendor": "Progress Software", "versions": [{"lessThan": "15.2.8441", "status": "affected", "version": "15.2.8400", "versionType": "custom"}, {"lessThan": "15.3.8531", "status": "affected", "version": "15.3.8500", "versionType": "custom"}, {"lessThan": "15.4.8630", "status": "affected", "version": "15.4.8600", "versionType": "custom"}]}], "source": "security@progress.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*", "matchCriteriaId": "55CA60C2-DDDC-44BA-A47D-934F3F946F37", "versionEndExcluding": "15.2.8441", "versionStartIncluding": "15.2.8400", "vulnerable": true}, {"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*", "matchCriteriaId": "B6C4CF7C-2C10-46F6-93C4-AC37A25CABE4", "versionEndExcluding": "15.3.8531", "versionStartIncluding": "15.3.8500", "vulnerable": true}, {"criteria": "cpe:2.3:a:progress:sitefinity:*:*:*:*:*:*:*:*", "matchCriteriaId": "A0699CBF-3C82-416C-AC88-747609F482AC", "versionEndExcluding": "15.4.8630", "versionStartIncluding": "15.4.8600", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users."}, {"lang": "es", "value": "CWE-639: Omisi\u00f3n de autorizaci\u00f3n mediante clave controlada por el usuario en servicios web en Progress Sitefinity 15.2.x anterior a 15.2.8441, 15.3.x anterior a 15.3.8531 y 15.4.x anterior a 15.4.8630 permite a un atacante remoto autenticado modificar las propiedades de la cuenta de otros usuarios, lo que podr\u00eda llevar al compromiso de la cuenta. La explotaci\u00f3n exitosa requiere el conocimiento de valores que generalmente no est\u00e1n expuestos a usuarios con pocos privilegios."}], "id": "CVE-2026-7201", "lastModified": "2026-07-22T19:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@progress.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7201", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-06-02T15:12:20.415939Z", "version": "2.0.3"}}]}, "published": "2026-06-02T14:17:14.360", "references": [{"source": "security@progress.com", "tags": ["Vendor Advisory"], "url": "https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@progress.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.2.8400,15.2.8441)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.3.8500,15.3.8531)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[15.4.8600,15.4.8630)"}}], "enrichment": {"confidence": 81.0, "confidence_source": "matching", "scores": [{"score": 81.0, "source": "matching"}]}, "original": {"product": "Sitefinity", "source": "cna", "vendor": "Progress Software"}, "product": "sitefinity", "vendor": "progress"}], "created": "2026-06-02T15:30:11.941956+00:00", "updated": "2026-06-02T20:00:12.894198+00:00", "vendors": ["progress", "progress$PRODUCT$sitefinity"]}