Two Critical MarkLogic Flaws Enable Privilege Escalation to Administrator Control

Progress Software has disclosed 31 security vulnerabilities in its MarkLogic Server database platform, including two critical flaws that permit privilege escalation from delegated management accounts to full administrator control. The vendor published the advisory on October 12, rating five of the vulnerabilities as critical severity.

Vulnerability Details

The two most serious flaws allow user accounts that have been granted limited management privileges to escalate their access and obtain persistent administrator-level control over the MarkLogic Server instance. This type of privilege escalation represents a significant risk for organizations that rely on role-based access controls to protect sensitive data stored in database systems.

Patches Available Since September

Progress Software released security updates addressing all 31 vulnerabilities on September 10, ahead of the public disclosure. The fixes are included in MarkLogic version 11.3.7 and version 12.1.0. Organizations running earlier versions remain exposed to potential exploitation.

Implications for Regulated Institutions

For financial institutions, healthcare providers, and other regulated entities in the Kingdom that deploy MarkLogic Server for data management, these vulnerabilities pose compliance and operational risks. Database systems often store customer records, financial transactions, and other sensitive information subject to regulatory protection requirements. Unauthorized administrator access could lead to data breaches, unauthorized modifications, or compliance violations under applicable frameworks.