Improper input validation in the web services of Progress Sitefinity allows a remote, unauthenticated attacker to compromise the integrity and confidentiality of user accounts. The flaw can be used to alter or view account information, with the attacker requiring user interaction and the site to be configured in a non‑default mode.

The vulnerability affects Progress Software Sitefinity versions 14.1.x through 14.3.x, 14.4.x before 14.4.8152, 15.0.x before 15.0.8234, 15.1.x before 15.1.8335, 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630. These affected releases are listed in the advisory and are vulnerable when the web services are exposed through a non‑default configuration.

The vulnerability receives a CVSS score of 8.8, indicating high severity. EPSS data is not available and the issue is not listed in the CISA KEV catalog. The likely attack vector involves remote interaction with the vulnerable web services; exploitation requires the target to be accessible via the web and to have a configuration that enables the affected endpoints. While the score indicates significant impact, the absence of EPSS data and KEV listing suggests that exploitation may be less widespread at present, yet the combination of high severity and remote unauthenticated access warrants immediate attention.