This vulnerability (CVE-2026-7327) in Progress MarkLogic Server versions 11.0.0 and 12.0.0 is due to improper privilege management within the REST API document processing pipeline. An authenticated user holding an administrative REST role can exploit this flaw to escalate their privileges beyond intended limits. The consequence is potential unauthorized access to sensitive data that should only be accessible to higher-privileged users. The CVSS 3.1 base score is 8.1, reflecting network attack vector, low attack complexity, high privileges required, user interaction needed, scope change, and high confidentiality and integrity impact but no availability impact. No official patch or remediation guidance has been published by the vendor as of the data provided.

Successful exploitation allows an authenticated administrative REST user to escalate privileges, resulting in unauthorized disclosure of sensitive server-side data. This compromises confidentiality and integrity of the affected system's data. There is no indication of availability impact. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative REST role assignments to trusted users only and monitor for suspicious privilege escalation attempts. Follow vendor advisories closely for updates on patches or official mitigations.