This vulnerability in Progress MarkLogic Server's REST API document patch operation allows an authenticated user with limited REST privileges to escalate their privileges improperly and execute privileged operations against the Security database. It affects versions 11.0.0 and 12.0.0 of MarkLogic Server. The vulnerability is classified under CWE-269 (Improper Privilege Management) and has a critical CVSS 3.1 score of 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or official remediation level has been disclosed as of the publication date.

An attacker with low-privileged REST API access can escalate privileges to perform sensitive operations on the Security database, potentially compromising the entire system's security, including unauthorized data access, modification, or denial of service. The critical CVSS score indicates a high risk of severe impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict REST API access to trusted users only and monitor for unusual privilege escalation attempts. Follow vendor communications closely for updates on patches or official mitigations.