CVE-2026-7329 - Privilege escalation in Progress MarkLogic Server REST query interfaces

Back Back to CVE browser

CRITICAL

Privilege escalation in Progress MarkLogic Server REST query interfaces

Published Aug 5, 2026

9.9

CRITICAL

CVSS 3.1

EPSS 0.57%

Description

An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.

Affected products

Vendor Progress Software Corporation Product MarkLogic Server Default
unaffected
- Version
  11.0.0
  Status
  affected
  Constraints
  <11.3.6
- Version
  12.0.0
  Status
  affected
  Constraints
  <12.0.3

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Progress Software Corporation

MarkLogic Server

unaffected

Version	Status	Constraints
11.0.0	affected	<11.3.6
12.0.0	affected	<12.0.3

Remediation

Vendor solution

Restrict network access to REST query interfaces to trusted users and networks. Minimize assignment of REST roles.

Weaknesses (1)

CWE-269

Improper Privilege Management

References (2)

https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026
vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53423
Advisory

Link	Providers	Tags
https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026		vendor-advisoryVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-53423		Advisory