CVE-2026-7329
CriticalCVSS 9.9Summary
An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.
Risk Assessment
Risk of privilege escalation to administrator level, potentially leading to full system control and unauthorized access to sensitive data.
Recommendation
Upgrade Progress MarkLogic Server to version 11.3.6 or 12.0.3 (or later). Also review and restrict privileges assigned to REST roles.
Original NVD description (English source)
An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.