AI description
CVE-2026-85956 is an improper privilege management vulnerability (CWE-269) affecting Progress MarkLogic Server versions 11.x prior to 11.3.7 and 12.x prior to 12.1.0. The flaw allows a remote attacker who already possesses delegated database-administrator privileges to perform backup or restore operations on database forests that lie outside their authorized database scope. This occurs because the server previously authorized backup and restore requests based on the database identified in the request URL rather than validating the actual databases and forests named within the request itself. Exploiting this vulnerability can lead to unauthorized access to or modification of security-critical data. To address the issue, Progress Software released updates in MarkLogic Server versions 11.3.7 and 12.1.0, which enforce authorization checks against the actual databases and forests specified in the backup or restore requests. Organizations are advised to upgrade to these patched versions and review delegated forest and database privilege assignments.
- Description
- Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator privileges to perform backup or restore operations on forests outside the authorized database scope, which could result in unauthorized access to or modification of security-critical data.
- Source
- security@progress.com
- NVD status
- Awaiting Analysis
CVSS 3.1
- Type
- Secondary
- Base score
- 9.6
- Impact score
- 5.8
- Exploitability score
- 3.1
- Vector string
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- Severity
- CRITICAL
- security@progress.com
- CWE-269
Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.
- Hype score
11