This vulnerability in MarkLogic Server allows an authenticated user with a low-privileged REST role to escalate their privileges to administrator via the SQL, SPARQL, and Optic REST query interfaces. This improper privilege management flaw affects versions 11.0.0 and 12.0.0, enabling unauthorized execution of privileged operations and access to sensitive data. The CVSS v3.1 base score is 9.9, indicating critical severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality, integrity, and availability with a scope change.

Successful exploitation allows an authenticated low-privileged user to gain administrator privileges, resulting in full control over the affected MarkLogic Server instance. This includes the ability to execute privileged operations and access or modify sensitive data without authorization, severely compromising system security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is provided in the available data. Users should monitor Progress Software Corporation advisories for updates and apply patches once available. Until then, restrict access to REST query interfaces to trusted users only.