Apache CouchDB 3.5.2 and Below Vulnerability with Missing Authorization Checks

CVE-2026-90800

What is CVE-2026-90800?

A vulnerability exists in Apache CouchDB versions 3.5.2 and below due to missing authorization checks in the chttpd component. This flaw allows unauthorized users to access the complete contents of databases with the prefixed identifiers _user and _replicator through unsecured API endpoints. Such access can pose significant security risks, particularly in contexts where sensitive information is stored. Users are strongly advised to update to version 3.5.3 or later, where this vulnerability has been addressed. The specific risk arises from the rare use of the affected prefixed system databases.

References