Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an authorization flaw in certain forest-management operations. A remote attacker with forest-management privileges could exploit this flaw to create a persistent unauthorized administrator account, potentially resulting in complete unauthorized administrative control of the server.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-10-12T16:17:06.040Z",
  "pubdate": "2026-10-12T16:17:06.040Z",
  "executiveSummary": "Progress MarkLogic Server is affected by an authorization vulnerability involving forest-management operations. This flaw allows a remote attacker possessing existing forest-management privileges to bypass standard security controls and create persistent, unauthorized administrator-level accounts. Successful exploitation grants the attacker full administrative control over the affected MarkLogic server instance. The vulnerability impacts MarkLogic Server 12.x versions prior to 12.1.0 and 11.x versions prior to 11.3.7. The risk to the organization is critical, as it enables privilege escalation and potential long-term persistence within the database environment. Exploitation requires the attacker to already hold forest-management privileges, suggesting an insider threat scenario or a compromised account with elevated, yet restricted, permissions. Organizations should prioritize patching to the specified secure versions to neutralize this escalation vector.",
  "technicalDetails": "The vulnerability resides within the forest-management functional modules of the Progress MarkLogic Server. The root cause is an improper authorization check or validation failure during specific administrative operations related to forest metadata or management configurations. While the server enforces role-based access control (RBAC) for standard operations, the internal logic governing forest-management tasks fails to sufficiently verify if the initiating user possesses the requisite administrative authorization to modify system-level security objects, such as user account management tables or authentication configurations.\nThe exploitation flow begins with an authenticated attacker who has already been granted the 'forest-management' role. In a typical secure environment, this role is scoped specifically to the maintenance of forests, including disk space management, reindexing, or backup configuration, and should strictly exclude user management or security configuration permissions. However, due to this flaw, the attacker can invoke specific API functions or management endpoints that interact with the underlying forest-management sub-processes.\nBy manipulating requests sent to these management endpoints, the attacker can trigger a side-effect that interacts with the server's security infrastructure. The flaw enables the unauthorized execution of administrative functions typically reserved for users with higher-level roles, such as 'admin' or 'security' roles. Specifically, the attacker leverages the improperly gated forest-management functionality to inject or define a new administrative user object.\nThe payload effectively persists in the server's backend configuration, as the system incorrectly validates the creation of this new account under the context of the elevated forest-management session. Once the account is created, the attacker can use these new credentials to authenticate to the MarkLogic Admin Interface or relevant APIs, gaining full administrative rights to the server.\nThis post-exploitation state provides the attacker with absolute control over the data, security policies, and operational integrity of the server. Potential impacts include unauthorized data access, exfiltration of sensitive information, modification of system configurations, and the installation of backdoors. Because the newly created account is persistent, the attacker can maintain this access even if the original forest-management account is modified or restricted, until the account object is manually identified and purged by a legitimate system administrator.\nThe vulnerability is localized to the server’s internal management framework and affects all deployment environments (on-premises or cloud) running the vulnerable versions 12.x < 12.1.0 and 11.x < 11.3.7."
}