MarkLogic Flaws Let Limited Users Seize Persistent Admin Control
Two critical vulnerabilities in Progress Software's MarkLogic Server (CVSS 9.9) allow users with delegated management privileges to escalate their access and gain persistent administrator control — a severe violation of the principle of least privilege. The root issue lies in flawed privilege enforcement within the database platform, meaning trust boundaries between role types were not properly enforced. This matters because database administrators often hold the keys to an organization's most sensitive data, and a compromised delegated account could silently maintain elevated access long after the initial exploit. With patches available since September 10 in versions 11.3.7 and 12.1.0, organizations running older versions remain exposed to complete database takeover.
Tactical Insight
Immediate Actions
- Patch all MarkLogic Server instances to version 11.3.7 or 12.1.0 immediately.
- Audit all delegated manager accounts to identify any suspicious privilege changes or unauthorized admin access.
- Restrict network access to MarkLogic Server instances to trusted hosts only while patching is underway.
Access Control Hardening
- Review and enforce least-privilege principles across all database user roles, removing any unnecessary delegated permissions.
- Implement multi-factor authentication (MFA) for all accounts with elevated database privileges.
- Enable comprehensive audit logging on privilege escalation events within MarkLogic Server.
Long-Term Improvements
- Establish a formal patch management SLA that mandates critical patches (CVSS ≥ 9.0) be applied within 72 hours of release.
- Integrate database assets into a continuous vulnerability scanning program to detect unpatched instances automatically.
- Conduct periodic access reviews (at least quarterly) to validate that role assignments align with business need.