CVE-2026-7329
Privilege escalation in Progress MarkLogic Server REST query interfaces
CVSS Score
9.9
EPSS Score
0.0%
EPSS Percentile
0th
An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.
| CWE | CWE-269 |
| Vendor | progress software corporation |
| Product | marklogic server |
| Published | Aug 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for progress software corporation marklogic server
Be the first to know when new critical vulnerabilities affecting progress software corporation marklogic server are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
Progress Software Corporation / MarkLogic Server
11.0.0 < 11.3.6 12.0.0 < 12.0.3
References
Credits
0xdln via Bugcrowd