CVE-2026-85950 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Progress MarkLogic Server versions prior to 12.1.0 and 11.x releases before 11.3.7 represents a critical authorization flaw within the application's authentication subsystem. This defect specifically impacts systems where an attacker has already obtained administrative privileges, indicating that this is not a remote code execution or unauthenticated access vulnerability but rather a privilege escalation issue stemming from improper security controls. The core technical failure lies in the server's handling of user credentials and authentication tokens. Specifically, the application fails to enforce strict separation between different levels of administrative authority when retrieving or exposing sensitive authentication material. This architectural oversight allows an entity operating with standard administrative rights to query internal data structures that store hashes, salts, or session tokens associated with users holding higher-privileged roles, such as super-administrators or system-level accounts.
From a technical perspective, this flaw aligns closely with CWE-284 Improper Access Control and CWE-539 Information Exposure Through Debugging Features if the exposure occurs via diagnostic endpoints, though it is more accurately categorized under CWE-732 Permission Assignment Errors for Incorrect Role in certain contexts where role-based access control logic fails to isolate credential stores. The vulnerability enables an attacker with lower-level administrative access to extract authentication material that should be strictly confined to higher-tier administrators. This extraction could involve plaintext passwords if the system is misconfigured, or more commonly, cryptographic hashes and session identifiers. In modern security architectures, even hashed credentials can be leveraged for offline brute-force attacks or pass-the-hash techniques, especially if weak hashing algorithms are in use. Furthermore, access to high-privilege session tokens allows an attacker to impersonate these users directly without needing to crack any passwords, leading immediate unauthorized administrative access.
The operational impact of this vulnerability is severe due to the nature of MarkLogic Server as a database and application platform often used for mission-critical data storage and processing. If an attacker successfully exploits this flaw, they can assume the identity of super-administrators, thereby gaining unrestricted control over the entire system. This includes the ability to read, modify, or delete any data stored within the server, alter security policies to maintain persistence, install malicious extensions or modules, and potentially pivot to other systems on the network if MarkLogic is integrated with external services. The attacker could also exfiltrate sensitive business intelligence, customer records, or intellectual property protected by these higher-privileged accounts. Since administrative access typically implies full system control, this vulnerability effectively compromises the confidentiality, integrity, and availability of all data managed by the instance.
This behavior maps to several techniques in the MITRE ATT&CK framework, particularly T1078 Valid Accounts, where attackers use legitimate credentials for unauthorized access, and potentially T1528 Steal Application Access Token if session tokens are compromised. The scenario also reflects aspects of T1098 Account Manipulation if the attacker uses extracted material to create backdoor accounts or modify existing permissions. Defense in depth is crucial here; while patching is the primary remediation, organizations should ensure that administrative access is strictly limited via network segmentation and multi-factor authentication where supported by the platform's configuration options prior to upgrade.
To mitigate this risk, administrators must immediately apply the vendor-provided patches for MarkLogic Server version 12.1.0 or later, or version 11.3.7 and later for the 11.x branch. These updates contain code changes that enforce stricter access controls on authentication-related endpoints and data structures, ensuring that lower-privileged administrators cannot query credentials belonging to higher-privileged users. In addition to patching, organizations should review their administrative account hierarchy to ensure that no single user holds excessive privileges unless absolutely necessary, adhering to the principle of least privilege. Regular audits of administrative activity logs can help detect any attempts to access sensitive authentication material before an exploit is fully realized. It is also recommended to rotate all passwords and invalidate existing session tokens for high-privileged accounts immediately after patching to ensure that any potentially compromised credentials are rendered useless by the vendor's fix implementation timeline.