CVE-2026-7201— CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity
Possible ATT&CK Techniques 1AI
T1078 · Valid AccountsAffected Version Matrix 3
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software | Sitefinity | 15.2.8400< 15.2.8441 | affected |
15.3.8500< 15.3.8531 | affected | ||
15.4.8600< 15.4.8630 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-7201
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity
Source: NVD (National Vulnerability Database)
Vulnerability Description
CWE-639: Authorization Bypass Through User-Controlled Key in web services in Progress Sitefinity 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 allows a remote authenticated attacker to modify account properties of other users, potentially leading to account compromise. Successful exploitation requires knowledge of values that are not generally exposed to low-privileged users.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Sitefinity | 15.2.8400 ~ 15.2.8441 | - |
II. Public POCs for CVE-2026-7201
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-7201
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-7201 (1)
Same Patch Batch · Progress Software · 2026-06-02 · 5 CVEs total
| CVE-2026-7312 | 10.0 CRITICAL | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity |
| CVE-2026-7198 | 9.8 CRITICAL | CWE-284: Improper Access Control in web services in Progress Sitefinity |
| CVE-2026-7195 | 8.8 HIGH | CWE-20: Improper Input Validation in web services in Progress Sitefinity |
| CVE-2026-7313 | 8.7 HIGH | CWE‑522: Insufficiently Protected Credentials in web services in Progress Sitefinity |
IV. Related Vulnerabilities
Same product: Sitefinity
- CVE-2026-7313
CWE‑522: Insufficiently Protected Credentials in web service - CVE-2026-7312
CWE‑522: Insufficiently Protected Credentials in web service - CVE-2026-7198
CWE-284: Improper Access Control in web services in Progress - CVE-2026-7195
CWE-20: Improper Input Validation in web services in Progres - CVE-2025-1968
Progress Sitefinity 代码问题漏洞
Same vendor: Progress Software
- CVE-2026-7313
CWE‑522: Insufficiently Protected Credentials in web service - CVE-2026-7312
CWE‑522: Insufficiently Protected Credentials in web service - CVE-2026-7198
CWE-284: Improper Access Control in web services in Progress - CVE-2026-7195
CWE-20: Improper Input Validation in web services in Progres - CVE-2026-8488
Allocation of resources without limits or throttling vulnera
Same weakness: CWE-639
- CVE-2026-24761
Kiteworks Secure Data Forms is vulnerable to Authorization B - CVE-2026-24756
Kiteworks Secure Data Forms is vulnerable to Authorization B - CVE-2026-24755
Kiteworks Secure Data Forms is vulnerable to Authorization B - CVE-2026-24753
Kiteworks Secure Data Forms is vulnerable to Authorization B - CVE-2026-23638
Kiteworks Secure Data Forms is vulnerable to Authorization B
V. Comments for CVE-2026-7201
No comments yet