CVE-2026-7329: Privilege escalation in Progress MarkLogic Server REST query interfaces
An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.6 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.0.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7329?
CVE-2026-7329 has a critical severity rating of 9.9.
What types of operations can be executed through the CVE-2026-7329 vulnerability?
Through CVE-2026-7329, an authenticated low-privileged user can escalate privileges to execute privileged operations.
Which versions of Progress MarkLogic Server are affected by CVE-2026-7329?
CVE-2026-7329 affects Progress MarkLogic Server versions prior to 11.3.6 and 12.0.3.
How can I mitigate the risk associated with CVE-2026-7329?
To mitigate the risk of CVE-2026-7329, upgrade to Progress MarkLogic Server version 11.3.6 or 12.0.3 or later.
Is it necessary for an attacker to be authenticated to exploit CVE-2026-7329?
Yes, an attacker needs to be an authenticated user with a low-privileged REST role to exploit CVE-2026-7329.