An XQuery injection flaw exists in a deprecated Management API package path of Progress MarkLogic Server. A remote attacker who already holds manage‑user privileges can exploit this path and obtain persistent, unauthorized administrative control. The weakness is a classic example of improper privilege management (CWE‑269).

The vulnerability affects Progress MarkLogic Server. On the 12.x line, all releases prior to 12.1.0 are vulnerable. On the 11.x line, all releases prior to 11.3.7 are affected.

The CVSS score of 9.9 classifies the flaw as critical. Although no EPSS score is available and it is not listed in the CISA KEV catalog, the high severity and the fact that the flaw requires only manage‑user credentials imply a real risk. The likely attack vector is a remote, authenticated request targeting the vulnerable Management API endpoint.