{"api_version":"1","generated_at":"2026-08-05T20:40:01+00:00","cve":"CVE-2026-7327","urls":{"html":"https://cve.report/CVE-2026-7327","api":"https://cve.report/api/cve/CVE-2026-7327.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-7327","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-7327"},"summary":{"title":"Privilege escalation in Progress MarkLogic Server REST API document processing","description":"An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-side data when it is accessed by a higher-privileged user.","state":"PUBLISHED","assigner":"ProgressSoftware","published_at":"2026-08-05 16:17:09","updated_at":"2026-08-05 19:17:41"},"problem_types":["CWE-269","CWE-269 CWE-269: Improper Privilege Management"],"metrics":[{"version":"3.1","source":"security@progress.com","type":"Secondary","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.1","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","version":"3.1"}}],"references":[{"url":"https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026","name":"https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026","refsource":"security@progress.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-7327","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-7327","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Progress Software Corporation","product":"MarkLogic Server","version":"affected 11.0.0 11.3.6 custom","platforms":[]},{"source":"CNA","vendor":"Progress Software Corporation","product":"MarkLogic Server","version":"affected 12.0.0 12.0.3 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[{"source":"CNA","title":"","value":"Restrict REST API configuration access to trusted administrators. Review users with elevated REST administration privileges, remove unnecessary assignments, and review configured server-side document transforms for unexpected changes.","time":"","lang":"en"}],"exploits":[],"credits":[{"source":"CNA","value":"rexnets via Bugcrowd","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"metrics":[{"other":{"content":{"id":"CVE-2026-7327","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"role":"CISA Coordinator","timestamp":"2026-08-05T18:11:12.714418Z","version":"2.0.3"},"type":"ssvc"}}],"providerMetadata":{"dateUpdated":"2026-08-05T18:42:34.005Z","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP"},"title":"CISA ADP Vulnrichment"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"MarkLogic Server","vendor":"Progress Software Corporation","versions":[{"lessThan":"11.3.6","status":"affected","version":"11.0.0","versionType":"custom"},{"lessThan":"12.0.3","status":"affected","version":"12.0.0","versionType":"custom"}]}],"credits":[{"lang":"en","type":"finder","value":"rexnets via Bugcrowd"}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-side data when it is accessed by a higher-privileged user.</p>"}],"value":"An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-side data when it is accessed by a higher-privileged user."}],"impacts":[{"descriptions":[{"lang":"en","value":"Privilege Escalation"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.1,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-269","description":"CWE-269: Improper Privilege Management","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-08-05T15:30:40.887Z","orgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","shortName":"ProgressSoftware"},"references":[{"tags":["vendor-advisory"],"url":"https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026"}],"source":{"discovery":"EXTERNAL"},"title":"Privilege escalation in Progress MarkLogic Server REST API document processing","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"<p>Restrict REST API configuration access to trusted administrators. Review users with elevated REST administration privileges, remove unnecessary assignments, and review configured server-side document transforms for unexpected changes.</p>"}],"value":"Restrict REST API configuration access to trusted administrators. Review users with elevated REST administration privileges, remove unnecessary assignments, and review configured server-side document transforms for unexpected changes."}],"x_generator":{"engine":"Vulnogram 0.2.0"}}},"cveMetadata":{"assignerOrgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","assignerShortName":"ProgressSoftware","cveId":"CVE-2026-7327","datePublished":"2026-08-05T15:30:40.887Z","dateReserved":"2026-04-28T16:08:42.705Z","dateUpdated":"2026-08-05T18:42:34.005Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-05 16:17:09","lastModifiedDate":"2026-08-05 19:17:41","problem_types":["CWE-269","CWE-269 CWE-269: Improper Privilege Management"],"metrics":{"cvssMetricV31":[{"source":"security@progress.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N","baseScore":8.1,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"HIGH","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"NONE"},"exploitabilityScore":1.7,"impactScore":5.8}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-08-05T18:11:12.714418Z","id":"CVE-2026-7327","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"7327","Ordinal":"1","Title":"Privilege escalation in Progress MarkLogic Server REST API docum","CVE":"CVE-2026-7327","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"7327","Ordinal":"1","NoteData":"An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-side data when it is accessed by a higher-privileged user.","Type":"Description","Title":"Privilege escalation in Progress MarkLogic Server REST API docum"}]}}}