The vulnerability allows an attacker to supply user-controlled values to higher‑order XQuery functions that are executed in an elevated security context. This flaw can be exploited to elevate privileges beyond those originally granted to the attacker, enabling unauthorized access to data or administrative operations. The weakness is a classic privilege‑escalation issue arising from improper privilege management. The description specifies that the flaw resides in the XQuery engine’s processing of user input, a direct path to escalated permissions.

Progress Software Corporation’s MarkLogic Server is affected. Vulnerable releases include all 12.x versions prior to 12.1.0 and all 11.x versions prior to 11.3.7. Any deployment of these releases that allows user-submitted XQuery code to run under higher-privilege contexts is at risk.

The CVSS score of 8.6 indicates a high severity for this flaw. EPSS data is not available, and the vulnerability is not currently listed in the CISA KEV catalog. Exploitation requires the attacker to inject crafted values into higher‑order XQuery functions, typically via exposed database services or web interfaces. This suggests that unauthenticated or authenticated users with access to XQuery endpoints could trigger privilege escalation, making the attacker’s success likely if the environment permits such input. The likely attack vector is through the database’s XQuery API, and the flaw remains exploitable until the vulnerability is corrected by the vendor.