CVE-2026-107755

EUVD-2026-105101
Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
6 MEDIUM
NETWORK
LOW
LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
Base Score
CVSS 3.x
EPSS Score
Percentile: 47.63%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
apachecouchdb
𝑥
< 3.5.3
CNA
Common Weakness Enumeration
References
https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
https://lists.apache.org/thread/ro57p4r2lhxn2n4712ppx7r11oqq900n
http://www.openwall.com/lists/oss-security/2026/10/20/16