Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 allow a remote attacker with delegated database-administrator… (CVE-2026-85956)

CVE-2026-85956 affects Progress MarkLogic Server 12.x releases prior to 12.1.0 and 11.x releases prior to 11.3.7. The vulnerability permits a remote attacker who has delegated database-administrator privileges to perform backup or restore operations on forests beyond their authorized database scope. This improper authorization flaw can result in unauthorized access to or modification of sensitive security-critical data within the system. The CVSS v3.1 base score is 9.6, indicating critical impact with network attack vector, low attack complexity, required privileges at delegated database-administrator level, no user interaction, and high confidentiality and integrity impact.

An attacker with delegated database-administrator privileges can exploit this vulnerability to access or modify security-critical data outside their authorized scope by performing unauthorized backup or restore operations on forests. This compromises the confidentiality and integrity of sensitive data within the affected MarkLogic Server instances.

A fix is available in Progress MarkLogic Server versions 12.1.0 and 11.3.7 and later. Users should upgrade to these or later versions to remediate this vulnerability. Since this is not a cloud service, patching the affected software is required to mitigate the risk.