CVE-2026-90800

EUVD-2026-105100
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.


The use of prefixed system databases is very rare.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
apacheCNA
8.1 HIGH
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
Base Score
CVSS 3.x
EPSS Score
Percentile: 49.59%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
apachecouchdb
𝑥
< 3.5.3
CNA
Common Weakness Enumeration
References
https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
https://lists.apache.org/thread/vng8vqjwgy1qlrv14wzrgs7pv4gj7gwr
http://www.openwall.com/lists/oss-security/2026/10/20/15