EUVD-2026-53425
GHSA-8pvj-2hqp-qwfr
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Network-reachable REST API (AV:N/AC:L), any low-privileged REST role suffices (PR:L), and patching the separate Security database crosses an authority boundary (S:C) yielding full C/I/A impact.
Primary rating from Vendor (ProgressSoftware).
CVSS VectorVendor: ProgressSoftware
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
An improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute privileged operations against the Security database.
AnalysisAI
Privilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user holding only a low-privileged REST role to abuse the REST API document patch operation, gaining the ability to run privileged operations against the internal Security database and effectively take over authorization data. Rated CVSS 9.9 with a changed scope, it is exploitable by any low-privileged REST account over the network. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated account holding at least a low-privileged REST role (CVSS PR:L) with network access to the MarkLogic REST API, and the attack is directed specifically at the REST API document patch operation targeting the Security database. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals align toward genuinely high risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who has obtained or been issued a low-privileged REST role (for example, a compromised application service account) sends a crafted document patch request through the MarkLogic REST API targeting the Security database, altering role or permission documents to grant themselves administrative authority. Because attack complexity is low and no user interaction is needed, a single valid low-privileged credential is enough to pivot to full control of the server's authorization model. … |
| Remediation | Upgrade to a fixed release: Vendor-released patch: MarkLogic Server 11.3.6 for the 11.x branch or 12.0.3 for the 12.x branch, per the Progress August 2026 Critical Security Alert Bulletin (https://community.progress.com/s/article/Marklogic-Critical-Security-Alert-Bulletin-August-2026). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Progress MarkLogic Server instances and identify those running versions before 11.3.6 (for v11) or 12.0.3 (for v12), documenting network exposure and connected user accounts. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Marklogic Server
View allPrivilege escalation in Progress MarkLogic Server before 11.3.6 and 12.0.3 lets an authenticated user holding only a low
Privilege escalation in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an authenticated user holding
Authentication bypass in the ODBC App Server of Progress MarkLogic Server (before 11.3.6 and 12.0.3) lets an unauthentic
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0
HTTP request smuggling in Progress MarkLogic Server's HTTP App Server (versions before 11.3.6 and 12.0.3) lets a remote
Authentication bypass in Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets an unauthenticated remote at
Server-side request forgery in Progress MarkLogic Server before 11.3.6 and 12.0.3 enables authenticated low-privileged u
Privilege escalation in Progress MarkLogic Server's REST API document processing pipeline allows an authenticated user h
Cross-site request forgery in the Progress MarkLogic Server Admin UI allows a remote, unauthenticated attacker to trigge
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today