CouchDB before 3.5.3 leaks other users' replication credentials
Original title: CVE-2026-107755: Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
An authenticated user can read replication credentials stored for other users in the _replicator database.
Jan Lehnardt reported CVE-2026-107755 in Apache CouchDB 3.5.2 and below on all platforms. Insufficient filtering of credentials in the _replicator database lets an authenticated user read replication credentials belonging to other users, not only their own. Affected releases are those before 3.5.3. Rated important, with CVSS 4.0 6.0 (medium).
Unconfirmed: The user recommendation is cut off in the posted snippet.
- CVSS 4.0 score is 6.0, labeled important.
- Flaw is in the _replicator database on all platforms.
- Access requires an authenticated user; confidentiality and integrity are rated high.
Impact: Authenticated user reads other users' replication credentials
| Product | Affected | Fixed in |
|---|---|---|
| Apache CouchDB | 3.5.2 and below (before 3.5.3) | 3.5.3 |
- 1.Upgrade Apache CouchDB to 3.5.3.
- CVEs
- CVE-2026-107755
- Vendors
- Apache
- Products
- Apache CouchDB
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-107755 | Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read… | 6.0 | — |
From the original article
Posted by Jan Lehnardt on Oct 20 Severity: important CVSS 4. 0: 6. 0 (medium) CVSS:4.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.