The vulnerability is an improper access control flaw (CWE‑284) in the web services of Progress Sitefinity. A remote attacker, without authentication, can call web service endpoints and obtain data that should be restricted, allowing them to read, modify or delete content and thereby compromising the confidentiality, integrity, and availability of the affected installation.

Affected products are Progress Sitefinity versions 15.4.8623 and earlier, up to but not including 15.4.8630. The flaw resides in the web services component that handles content requests.

The CVSS base score of 9.8 classifies this flaw as Critical. The EPSS score is not available, yet the lack of an EPSS value does not diminish the risk of a remote unauthenticated attacker. The vulnerability is not listed in the CISA KEV catalog, but the nature of the flaw makes it highly attractive to threat actors. Exploitation requires sending crafted requests to the unprotected web service endpoints, a task that is feasible over the internet.