An authorization flaw in forest‑management operations allows a remote attacker who has forest‑management privileges to create a persistent unauthorized administrator account, potentially granting complete administrative control of the server. The weakness is a classic example of improper privilege assignment.

Progress Software Corporation’s MarkLogic Server is affected. All 12.x releases prior to 12.1.0 and all 11.x releases prior to 11.3.7 contain the flaw.

The CVSS score of 9.9 indicates a critical severity and high impact on confidentiality, integrity, and availability. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote connection from an entity that already holds forest‑management privileges; once exploited, the attacker can persistently elevate authority by creating a new administrator account.