Two Critical MarkLogic Flaws Could Give Delegated Managers Persistent Admin Control

Two critical vulnerabilities in Progress Software's MarkLogic Server (CVSS 9.9) allow users with delegated management privileges to escalate their access and gain persistent administrator control — a severe violation of the principle of least privilege. The root issue lies in flawed privilege enforcement within the database platform, meaning trust boundaries between role types were not properly enforced. This matters because database administrators often hold the keys to an organization's most sensitive data, and a compromised delegated account could silently maintain elevated access long after the initial exploit. With patches available since September 10 in versions 11.3.7 and 12.1.0, organizations running older versions remain exposed to complete database takeover.