This vulnerability (CVE-2026-7201) in Progress Software Sitefinity involves an authorization bypass through user-controlled keys in web services. It affects versions 15.2.x prior to 15.2.8441, 15.3.x prior to 15.3.8531, and 15.4.x prior to 15.4.8630. A remote attacker with authenticated access can leverage knowledge of specific, non-public values to modify other users' account properties, potentially leading to account compromise. The CVSS 3.1 score of 8.8 reflects high impact on confidentiality, integrity, and availability. The vendor has not yet published a patch or official remediation details, and no cloud service is involved.

Successful exploitation allows a remote authenticated attacker to modify account properties of other users, which can lead to account compromise. This impacts confidentiality, integrity, and availability of user accounts within the affected Sitefinity versions. The vulnerability requires authenticated access and knowledge of certain values not typically available to low-privileged users. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict authenticated user privileges to the minimum necessary and monitor for suspicious account modifications. Avoid exposing or sharing internal values that could be used to exploit this vulnerability.