Progress MarkLogic Server versions before 12.1.0 and 11.3.7 contain an authorization flaw that allows a remote attacker who already has administrative privileges to read authentication data belonging to higher‑privileged users, potentially giving the attacker full administrative control over the system.

Progress Software Corporation's MarkLogic Server, specifically all 12.x releases earlier than 12.1.0 and all 11.x releases earlier than 11.3.7.

The vulnerability is rated with a CVSS score of 8.4 and is currently listed as not in the CISA KEV catalog. The EPSS score is not available. Because the flaw requires that the attacker already possess administrative credentials, the attack vector is constrained to privileged accounts, yet once that condition is met the attacker can elevate privileges to full administrator level. This high‑severity flaw is therefore significant for any environment where administrative accounts are used for legitimate tasks, and could be leveraged by an insider or compromised privileged account to gain unrestricted access.