Critical · 9.8 CVE-2026-7198 EUVD-2026-33919GHSA-9pjg-65cc-3h57

CWE-284: Improper Access Control in web services in Progress Sitefinity

Published Jun 2, 2026 · Updated Jun 3, 2026 · Assigned by ProgressSoftware

Vendor: Progress Software Product: Sitefinity

Description

CWE-284: Improper Access Control in web services in Progress Sitefinity 15.4.8623 before 15.4.8630 allows a remote unauthenticated attacker to access content that should be restricted, resulting in full compromise of confidentiality, integrity, and availability of affected installations.

Affected products

Vendor	Product	Affected	Fixed
Progress Software	Sitefinity	15.4.8623 – < 15.4.8630	15.4.8630

Advisories 1

WID-SEC-2026-1783 Progress Software Sitefinity: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 2, 2026

References

https://community.progress.com/s/article/Sitefinity-Security-Advisory-for-Addressing-Security-Vulnerabilities-CVE-2026-7312-CVE-2026-7198-CVE-2026-7195-CVE-2026-7201-CVE-2026-7313-May-2026 vendor-advisory

CNA	v3.1	9.8
EUVD	v3.1	9.8