CVE-2026-90800
Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
Apache Software Foundation Apache CouchDBDatabases
CVSS
8.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.63%Chance of exploitation activity in the next 30 days, higher than 49% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 3.5.3Apache CouchDBCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.
The use of prefixed system databases is very rare.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Text from CVE List
Affected versions 1
- Apache CouchDBaffected: all versions before 3.5.3CVE List