A vulnerability in Progress Sitefinity web services allows a remote authenticated attacker to change account properties of other users, potentially enabling full account takeover. The flaw, classified as an Authorization Bypass through user-controlled key, allows the attacker to alter values that are normally hidden from low-privileged users.

Progress Software Sitefinity versions 15.2.x before 15.2.8441, 15.3.x before 15.3.8531, and 15.4.x before 15.4.8630 are affected.

The CVSS score of 8.8 indicates high severity, but the attack requires remote authentication and knowledge of internal key values that are not typically exposed, raising the exploitation barrier. The EPSS data is not available and the vulnerability is not listed in CISA KEV. Exploitation would likely come through exposed web service endpoints and could be carried out by an attacker who has gained initial authenticated access to the application.