CVE-2026-85956: Improper privilege management in Progress MarkLogic Server backup and restore operations
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 12.1.0 - Upgrade
Upgrade
Progress MarkLogic Serverto a version that resolves this vulnerability.Fixed in 11.3.7
Event History
Frequently Asked Questions
Which deployments are affected?
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 are affected.
What level of access does an attacker need?
An attacker needs remote access and delegated database-administrator privileges. No user interaction is required.
What can an attacker do with successful exploitation?
The attacker can perform backup or restore operations on forests outside their authorized database scope, potentially gaining unauthorized access to or modifying security-critical data.
What versions address the issue?
Upgrade MarkLogic Server 12.x to 12.1.0 or later, or 11.x to 11.3.7 or later.