CouchDB before 3.5.3 allows unauthenticated reads of prefixed system DBs
Original title: CVE-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
Missing checks in chttpd expose the full contents of prefixed _users or _replicator databases.
CVE-2026-90800 affects Apache CouchDB 3.5.2 and below on all platforms. Missing authorization checks in chttpd let any request read the full contents of a prefixed _users or _replicator database through an unauthorized API endpoint. Versions before 3.5.3 are affected. CVSS 4.0 is 8.1 (high).
Unconfirmed: The note on prefixed system databases is cut off, and no exploitation status is stated.
- No privileges are required; the vector is network.
- Both prefixed _users and _replicator databases are in scope.
- Confidentiality and integrity impacts are rated high; availability is none.
Impact: Unauthenticated read of prefixed _users or _replicator databases
| Product | Affected | Fixed in |
|---|---|---|
| Apache CouchDB | 3.5.2 and below (before 3.5.3) | 3.5.3 |
- 1.Upgrade Apache CouchDB to 3.5.3.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90800 | Missing auth checks in Apache CouchDB prefixed system DBs | 8.1 | — |
From the original article
Posted by Jan Lehnardt on Oct 20 Severity: CVSS 4. 0: 8. 1 (high) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.