The vulnerability is an improper privilege management flaw in the REST API document processing pipeline of Progress MarkLogic Server. An authenticated user who holds an administrative REST role can exploit this flaw to gain elevated privileges, enabling unauthorized disclosure of sensitive server-side data when accessed by a higher-privileged user. This weakness corresponds to CWE-269.

The affected product is Progress Software Corporation MarkLogic Server. Versions earlier than 11.3.6 and 12.0.3 are vulnerable, covering all 11.x releases up through 11.3.5 and all 12.0.x releases up through 12.0.2.

The CVSS score is 8.1, indicating high severity. The EPSS score is not available, so the current exploitation probability is unknown. The vulnerability is not listed in CISA KEV. An attacker must first authenticate to the server with an administrative REST role; once authenticated, the flaw can be used to elevate privileges within the REST API document processing pipeline. The impact is limited to environments where such roles are improperly assigned or the REST API configuration is exposed to untrusted users.