CVE-2026-7327
Received Received - Intake

Improper Privilege Escalation in Progress MarkLogic Server

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: Progress Software Corporation

Description
An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-side data when it is accessed by a higher-privileged user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-7327
EUVD
EUVD-2026-53422

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
progress marklogic_server to 11.3.6|end_excluding=12.0.3 (exc)
progress marklogic_server to 12.0.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an improper privilege management issue in Progress MarkLogic Server's REST API document processing pipeline. It allows an authenticated user with an administrative REST role to escalate their privileges. This could lead to unauthorized access to sensitive server-side data when accessed by a higher-privileged user.

Impact Analysis

If exploited, this vulnerability could allow an attacker with administrative REST access to gain higher privileges than intended. This might result in unauthorized disclosure or manipulation of sensitive server data, potentially compromising system integrity and confidentiality.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized disclosure of personal or health data could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Update Progress MarkLogic Server to version 11.3.6, 12.0.3, or later to address the improper privilege management vulnerability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-7327. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart