EUVD-2026-53423
GHSA-vhc6-v3vv-rx25
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable REST endpoints (AV:N/AC:L), requires a low-privileged authenticated REST role (PR:L), no interaction (UI:N), and escalation to admin crosses the authorization boundary (S:C) with full C/I/A impact.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
An improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to administrator. This enables execution of privileged operations and unauthorized data access.
AnalysisAI
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low-privileged REST role elevate to administrator through the SQL, SPARQL, and Optic REST query interfaces, after which they can run privileged operations and read data they were never authorized to see. The flaw is remotely reachable and requires only valid low-tier credentials, driving a critical 9.9 CVSS score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account that holds a low-privileged MarkLogic REST role (PR:L) with network reach to a MarkLogic App Server exposing the SQL, SPARQL, or Optic REST query interfaces; the attack is performed by issuing queries through one of those three specific interfaces. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority issue rather than an inflated CVSS. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An insider or an attacker who has phished or otherwise obtained a low-privileged MarkLogic REST account sends crafted SQL, SPARQL, or Optic queries to the server's REST query interface. By abusing the improper privilege handling in those interfaces, the queries execute with administrator authority, letting the attacker read restricted collections and perform privileged administrative operations. … |
| Remediation | Vendor-released patch: upgrade to MarkLogic Server 11.3.6 (for 11.x deployments) or 12.0.3 (for 12.x deployments), per the Progress advisory at https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Progress MarkLogic Server deployments running versions 11.3.0-11.3.5 or 12.0.0-12.0.2 and document all accounts assigned low-privileged REST roles. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Marklogic Server
View allPrivilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a l
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthentic
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged u
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user h
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigge
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today