Progress MarkLogic Server releases 12.x before version 12.1.0 and 11.x before 11.3.7 contain an improper privilege-management flaw that allows a remote attacker with delegated database‑administrator rights to execute backup or restore operations on forests outside the intended database scope. The vulnerability is a direct violation of the intended separation of data, exposing sensitive information or permitting its alteration. This issue maps to CWE‑269 and is reflected in a CVSS score of 9.6, indicating critical severity.

Affected systems are Progress Software Corporation’s MarkLogic Server. All 12.x releases prior to 12.1.0 and all 11.x releases prior to 11.3.7 are vulnerable.

The CVSS score of 9.6 reflects a high potential for impact, although the EPSS score is currently unavailable. The vulnerability is not listed in CISA’s KEV catalog, meaning no widely known exploits are documented yet. Based on the description, it is inferred that exploitation requires an attacker to first gain delegated database‑administrator privileges—a task that may be achieved through credential compromise, phishing, or misconfigured roles. Once privileged, the attacker can perform out‑of‑scope backup/restore operations, potentially reading or changing data that should remain protected.