Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.6",
  "pubDate": "2026-10-12T16:17:07.193Z",
  "pubdate": "2026-10-12T16:17:07.193Z",
  "executiveSummary": "A critical access control vulnerability exists in Progress MarkLogic Server that allows a remote attacker with delegated database-administrator privileges to perform unauthorized backup and restore operations.\nThe vulnerability resides in the administrative functionality governing forest management, specifically failing to enforce strict database-level boundary checks for authenticated users.\nAffected versions include MarkLogic Server 12.x prior to 12.1.0 and 11.x prior to 11.3.7.\nBy exploiting this flaw, a malicious actor possessing limited administrative rights can bypass security constraints to interact with forests outside their assigned database scope.\nThe primary risk involves the unauthorized extraction of security-sensitive data via illicit backups or the corruption and modification of data via forced restores into unauthorized forest locations.\nExploitation requires an authenticated session with delegated database-administrator privileges, meaning the attack vector is restricted to users already within the administrative ecosystem who are attempting to escalate their operational authority beyond their defined permissions.",
  "technicalDetails": "The root cause of this vulnerability is an insufficient authorization check during the execution of backup and restore operations within the MarkLogic Server management framework. Specifically, the system fails to validate that the target forest resource associated with an administrative request resides within the subset of databases authorized for the authenticated administrator's scope.\nIn a secure configuration, an administrator with 'delegated' privileges should only be permitted to perform administrative tasks on databases or forests explicitly assigned to their security role. However, due to the flaw in the administrative interface logic, the system does not enforce these boundaries when invoking backend backup or restore routines.\nThe exploitation flow begins when an attacker, already authenticated with delegated database-administrator privileges, crafts a specially formed administrative request—typically through the MarkLogic management API or Administration Interface—targeting a forest identifier (ID) that is technically outside their assigned privilege scope. Upon receiving this request, the server-side components responsible for administrative operations fail to verify if the requester has the appropriate permissions for the specific target forest. Consequently, the server proceeds to execute the backup or restore command with the full context of the elevated process.\nThis allows the attacker to read the contents of any forest stored within the MarkLogic cluster, effectively enabling the exfiltration of sensitive information contained in databases they are not authorized to manage. Furthermore, the ability to perform 'restore' operations permits an attacker to overwrite existing production data with arbitrary data, leading to a loss of data integrity, potential service denial, or the injection of malicious records into unauthorized databases.\nThis vulnerability highlights a bypass in the Principle of Least Privilege enforcement. Because the backend system functions operate with high-level authority once the initial (though improper) authorization check is passed, the attacker can influence the state of the entire MarkLogic installation despite their restricted account. The vulnerability is effective against MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7."
}