CVE-2026-85950: Improper privilege management in Progress MarkLogic Server REST extensions
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw that could allow a remote attacker with administrative privileges to access authentication material associated with higher-privileged users, potentially resulting in unauthorized administrative access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0
Event History
Frequently Asked Questions
Which deployments are affected?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected.
What level of access does an attacker need?
Exploitation requires remote access and administrative privileges, along with user interaction. The flaw may expose authentication material belonging to higher-privileged users.
What is the potential impact after exploitation?
An attacker could use accessed authentication material to obtain unauthorized administrative access. The reported impact includes compromise of confidentiality, integrity, and availability.
What versions address the issue?
Upgrade 12.x deployments to 12.1.0 or later, and 11.x deployments to 11.3.7 or later.