Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control
What Happened — Progress Software disclosed 31 new security flaws in MarkLogic Server; five are rated critical. Two of those flaws allow an account that only has limited management privileges to elevate to full administrator rights, effectively bypassing role‑based access controls. Patches have been released for MarkLogic 11.3.7 and 12.1.0.
Why It Matters for Trust & Control Assurance
- The scenario directly tests the access‑control control objective: ensuring that privileged‑escalation pathways are blocked and that least‑privilege principles are enforceable.
- Continuous control‑assurance programs rely on real‑time evidence that privileged‑access policies are effective; a flaw like this creates a blind spot that can invalidate audit evidence.
- Verisq’s ACCESS_CONTROLS capability provides automated validation of role‑based permissions and continuous monitoring of privilege‑escalation attempts, giving you defensible proof that the control is operating as intended.
Who Is Affected – Database vendors, SaaS platforms, and any organization that runs MarkLogic Server in production (e.g., financial services, healthcare analytics, government data portals).
Recommended Actions
- Apply the MarkLogic 11.3.7 or 12.1.0 patches immediately.
- Review all delegated‑manager accounts and verify that their permissions cannot be leveraged for privilege escalation.
- Enable continuous monitoring of privileged‑access events and map findings to the access‑control control objective in your audit framework.
- Document the remediation steps and retain logs as evidence for future audits.
Source: The Hacker News
Technical Notes – The two critical CVEs (CVE‑2026‑XXXX and CVE‑2026‑YYYY) involve insecure handling of delegated‑manager tokens, allowing an attacker to forge admin‑level requests. No public exploits are known, but the vulnerability is rated CVSS 9.8. The flaws affect MarkLogic Server 11.0‑12.0 prior to the patched releases.
Source: Progress Security Advisory (linked from article)