CVE-2026-85956 in MarkLogic Server
Summary
by MITRE • 10/12/2026
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/12/2026
The vulnerability identified in Progress MarkLogic Server versions prior to 12.1.0 and 11.x releases before 11.3.7 represents a critical privilege escalation flaw rooted in insufficient authorization checks within the database administration subsystem. This issue specifically affects users who have been granted delegated database-administrator privileges, a role typically intended for managing specific databases without granting full system-wide administrative control. The core technical flaw lies in the server's handling of backup and restore operations, where the access control logic fails to strictly enforce scope boundaries defined by the delegation policy. Instead of restricting these high-impact actions exclusively to forests associated with the authorized database, the application allows a remote attacker leveraging these delegated credentials to target any forest within the MarkLogic cluster. This architectural oversight effectively bypasses the intended isolation mechanisms that separate administrative duties across different data sets or tenants in multi-database environments.
From an operational perspective, this vulnerability poses severe risks to data integrity and confidentiality. Forests in MarkLogic Server are fundamental storage units that hold document content and indexes. By performing backup operations on unauthorized forests, an attacker can exfiltrate sensitive information stored outside the scope of their delegated authority. Conversely, restore operations allow for the overwriting or injection of malicious data into systems where the attacker should have no write access. This capability undermines the principle of least privilege, which is central to secure system design and compliance frameworks such as NIST SP 800-53 AC-6. The ability to manipulate security-critical data remotely means that a compromised account with delegated admin rights can serve as a pivot point for broader network compromise or persistent data tampering, affecting the availability and trustworthiness of the entire database cluster.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) categories such as CWE-269 Improper Privilege Management and CWE-732 Incorrect Permission Assignment for Critical Resource. The failure to validate that a requested operation falls within the permitted scope constitutes a classic authorization bypass scenario. In terms of attack vectors, this flaw facilitates actions consistent with MITRE ATT&CK technique T1083 File and Directory Discovery when used in conjunction with backup operations to enumerate sensitive data, or T1490 Inhibit System Recovery if restore operations are leveraged to overwrite critical system files or backups for denial-of-service purposes. The remote nature of the exploit allows attackers to execute these actions without requiring local shell access, increasing the attack surface significantly.
Mitigation strategies must prioritize immediate patching and strict role-based access control reviews. Organizations running affected versions should upgrade to MarkLogic Server 12.1.0 or later, as well as version 11.3.7 for those on the 11.x branch, where these authorization checks have been corrected to enforce scope boundaries rigorously. In environments where immediate patching is not feasible due to operational constraints, administrators should audit delegated database-administrator privileges and restrict them only to users who absolutely require such access. Additionally, implementing network-level controls to limit administrative API endpoints to trusted management networks can reduce exposure. Regular auditing of backup and restore logs for anomalies involving forests outside expected scopes provides an additional layer of defense through detection rather than prevention alone.