EUVD-2026-53422
GHSA-xp9q-9vhj-ggp6
Severity by source
AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
PR:H confirmed by requirement for administrative REST role; UI:R reflects mandatory higher-privileged user interaction; S:C and C:H/I:H reflect cross-privilege-boundary data access; A:N as no availability impact is described.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N
Lifecycle Timeline
3DescriptionCVE.org
An improper privilege management vulnerability in the REST API document processing pipeline of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with an administrative REST role to escalate privileges. This can result in unauthorized disclosure of sensitive server-side data when it is accessed by a higher-privileged user.
AnalysisAI
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user holding an administrative REST role to elevate their access to a higher privilege level, resulting in unauthorized disclosure of sensitive server-side data. Affected versions span both the 11.x and 12.x release trains, patched in 11.3.6 and 12.0.3 respectively per the vendor's August 2026 critical security bulletin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to possess a valid MarkLogic Server account with the administrative REST role assigned - this is a high-privilege role, not a standard user account, making opportunistic exploitation difficult. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS base score of 8.1 (AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:N) reflects high potential impact but meaningful exploitation prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or been granted an administrative REST role account submits specially crafted documents into the MarkLogic REST API document processing pipeline. When a higher-privileged user - such as a security administrator or super-admin - accesses or processes these documents, the pipeline triggers the privilege escalation flaw, granting the attacker access to sensitive server-side data that their original role should not permit them to read or modify. … |
| Remediation | The primary remediation is to upgrade MarkLogic Server to version 11.3.6 or 12.0.3, as confirmed by the vendor's Critical Security Alert Bulletin at https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all MarkLogic Server instances running versions 11.0-11.3.5 or 12.0.0-12.0.2 and classify by criticality. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Marklogic Server
View allPrivilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a l
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthentic
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged u
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigge
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today