Progress MarkLogic Server versions prior to 12.1.0 and 11.3.7 allow a remote authenticated attacker with limited management privileges to read security‑sensitive information. The flaw stems from insufficient access restrictions, effectively enabling the disclosure of data that should be protected. The consequence is a confidentiality breach that could be leveraged to gain further unauthorized access to protected resources. This weakness matches CWE‑200, which identifies failures to limit information exposure.

The vulnerability affects Progress Software Corporation’s MarkLogic Server. Specifically, any installation running version 12.x before 12.1.0 or version 11.x before 11.3.7 is subject to the flaw.

The CVSS score of 7.7 signals a high‑severity risk. The EPSS score is not reported, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a remotely authenticated user who possesses limited management permissions; the attacker must log into the management interface or use a valid credential to access the exposed data. Because the attack vector demands authentication, the threat surface is narrower than a public vulnerability, but the impact on confidentiality remains significant if successful.