Insufficient Credential Filtering in Apache CouchDB Affects User Data Security
CVE-2026-107755

6MEDIUM

Key Information:

Vendor

Apache
Status
Apache Couchdb
Vendor
CVE Published:
20 October 2026

What is CVE-2026-107755?

The vulnerability arises from insufficient filtering of replication credentials in the _replicator database of Apache CouchDB, specifically affecting version 3.5.2 and below across all platforms. This issue allows authenticated users to inadvertently access replication credentials belonging to other users, posing a significant risk to user data privacy and security. Users are advised to upgrade to version 3.5.3, which addresses this security flaw, ensuring the integrity of user replication credentials.

Affected Version(s)

Apache CouchDB 0 < 3.5.3

References

https://lists.apache.org/thread.html/pj83174r8f8f64odf47f...
release-notes
https://lists.apache.org/thread/ro57p4r2lhxn2n4712ppx7r11...
vendor-advisory

CVSS V4

Score:
6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Sakil Ahamed Gayen
.