EUVD-2026-97566
GHSA-f3gc-h5jh-3g69
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local low-privilege account on host
-
ExploitAccess overly permissive existing log files
-
ImpactRead sensitive data or alter log contents
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Permission assignment review
|
| Exploitation Conditions | Requires local, already-authenticated low-privilege OS access to the MarkLogic Server host (PR:L, AV:L) - not remotely exploitable and no user interaction needed. Exploitation is further limited to MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7, and critically only to log files created BEFORE remediation: the fix applies corrected default permissions to newly created and rotated logs, while existing logs retain their permissive permissions until manually fixed, so even a patched host remains exposed on legacy logs until they are cleaned. Risk is concentrated on multi-user hosts where untrusted local accounts exist. |
| Impact | Available signals point to a moderate, local-only risk rather than an urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, 7.1 High) requires local access and existing low-privilege credentials on the MarkLogic host, which sharply limits the exploitable population compared with a network-facing flaw. No EPSS score, KEV listing, or POC was provided, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The vendor-assigned C:H/I:H impact appears generous for a weakness scoped to log files (CWE-732, overly permissive OS permissions): realistic impact is reading sensitive data that happens to be logged and tampering with audit trails, which I assess as lower (see assessed_cvss_vector). Net: a legitimate hardening and forensic-integrity issue for multi-user MarkLogic hosts, but not a drop-everything remote threat; prioritize on systems where untrusted local users share the host. |
| Exploit ScenarioDerived | A local user holding a low-privilege account on the MarkLogic Server host reads log files that were created with overly permissive operating-system permissions, harvesting any sensitive data recorded in them, or modifies those logs to tamper with the audit trail. Because corrected permissions apply only to newly created and rotated logs, pre-remediation logs remain exposed until manually fixed. No public exploit identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 12, 2026
Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 create certain log files with overly permissive operating-system permissions, allowing a local, already-authenticated low-privilege user on the server host to read or alter log data (CWE-732). Exploitation requires local OS access to the MarkLogic host (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) and is not remotely reachable, so the practical risk is moderate and concentrated on multi-tenant or multi-user hosts where untrusted local accounts exist; no public exploit identified at time of analysis. Notably, the vendor fix only corrects the default permissions for newly created and rotated logs, so previously written log files on an upgraded host remain permissively accessible until an administrator manually remediates them.
RemediationAI
Upgrade to the fixed releases - MarkLogic Server 12.1.0 for the 12.x branch and 11.3.7 for the 11.x branch - which correct the default permissions applied to newly created and rotated log files. Because the fix is forward-looking only, administrators must additionally remediate existing logs on every host by tightening ownership and permissions on the MarkLogic log directories (for example, restricting them to the MarkLogic service account and root/administrators, removing world- and group-read/write bits) and by re-running log rotation so fresh files inherit the corrected defaults; note that over-restrictive permission changes can break log shipping, monitoring agents, or support bundles that expect to read those files, so validate collectors afterward. Until both steps are complete, compensate by limiting interactive local accounts on MarkLogic hosts, auditing the host for unexpected users or cron/scheduled tasks that could touch the log path, and treating log content as untrusted for forensic purposes on affected and previously-affected hosts. Where local multi-user access cannot be eliminated, restrict the log directory via OS ACLs, mount the log volume with restrictive options, and forward logs to a protected centralized collector so the tamperable local copies are not the system of record. Vendor guidance is available at the Progress advisory https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-October-2026.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-732, Incorrect Permission Assignment for Critical Resource. During log file creation and rotation, MarkLogic Server was assigning file-system permissions that were broader than necessary, so any local account able to reach the log directory could read sensitive operational data from the logs and, because write access was also exposed, potentially modify or tamper with log content - affecting integrity of audit/forensic records. The affected component is the server's logging subsystem on the host operating system; the CPE cpe:2.3:a:progress_software_corporation:marklogic_server identifies the MarkLogic Server product line, with vulnerable branches 12.x before 12.1.0 and 11.x before 11.3.7. The independent assessment rates confidentiality and integrity impact as Low (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N), which is more conservative than the vendor-supplied 7.1 score, reflecting that the attacker must already hold local low-privilege OS access on the MarkLogic host and that no remote vector, privilege escalation, or availability impact is demonstrated. An important structural detail of the defect is that the corrected default applies only at creation and rotation time, leaving pre-existing log files with their original permissive permissions.
Know when Marklogic Server gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Local authenticated user (AV:L/PR:L) with no barriers (AC:L/UI:N); impact confined to log data so C:L/I:L rather than the input H/H, and A:N as logs remain available.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
Lifecycle Timeline
2DescriptionCVE.org
Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 assign overly permissive operating-system permissions to certain log files, which could allow a local user to read or alter log data. The corrected default permissions apply to newly created and rotated logs; existing logs retain their current permissions until remediated.
Executive ViewAI
Progress MarkLogic Server deployments running 11.x or 12.x create log files with permissive operating-system permissions, allowing anyone with a local account on the database host to read or modify those logs. The exposure is limited to insiders or local users who already hold a valid low-privilege account on the server itself - there is no remote path - so the primary risk is unauthorized disclosure of log contents and tampering with audit or investigative records on multi-tenant, shared, or contractor-accessible hosts. Leadership should care because log integrity underpins incident response, compliance evidence, and forensic defensibility, and no vendor patch was identified at the time of this analysis.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict and re-permission MarkLogic log directories (640 files / 750 directories, owned by the service account), enforce least privilege and remove unnecessary local accounts and sudo rights on MarkLogic hosts, ship logs to a centralized read-only/immutable store to preserve a tamper-evident copy, enable file-integrity monitoring and alerting on log path permission changes or deletions, and manually reset permissions on all pre-existing log files, since the referenced vendor remediation (12.1.0 / 11.3.7) only corrects defaults for newly created and rotated logs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
More in Marklogic Server
View allAuthenticated XQuery injection in Progress MarkLogic Server 11.x before 11.3.7 and 12.x before 12.1.0 allows a remote at
An authenticated privilege-escalation flaw in Progress MarkLogic Server lets an attacker who already holds forest-manage
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a l
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthentic
Insufficient isolation in Progress MarkLogic Server 12.x before 12.1.0 and 11.x before 11.3.7 allows code executed throu
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote attacker to perform privileged admi
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged u
Exploit-DB