A critical privilege management flaw in Progress MarkLogic Server allows authenticated users to escalate privileges and execute sensitive operations against the security database.

The vulnerability exists within the REST API document patch operation, where insufficient privilege checks allow a user with a low-privileged role to bypass restrictions (CWE-269). This enables the execution of privileged commands specifically against the Security database, which governs access control for the entire system.

The ability to manipulate the Security database allows an attacker to create new administrative accounts, modify existing permissions, or grant themselves elevated roles. Given the CVSS score of 9.9, this represents a total compromise of the application's security model, likely leading to unauthorized data access and system-wide control.

Immediate Action: Apply the vendor-provided security patches by updating to MarkLogic Server version 11.3.6, 12.0.3, or newer.

Proactive Monitoring: Review REST API audit logs for unusual PATCH operations, particularly those targeting the Security database or involving unexpected user roles.

Compensating Controls: Restrict access to the REST API management endpoints to only essential administrative IP addresses while the update is being prepared.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability carries severe implications for system security. Administrators are advised to apply the vendor patches immediately to restore proper access control and prevent potential privilege escalation by authenticated users.