High severity · published Oct 20, 2026
CVE-2026-90800
Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.
The use of prefixed system databases is very rare.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AC
Apache CouchDB · Apache Software Foundation
before 3.5.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-90800
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-90800
lists.apache.org
https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
lists.apache.org
https://lists.apache.org/thread/vng8vqjwgy1qlrv14wzrgs7pv4gj7gwr
www.openwall.com
http://www.openwall.com/lists/oss-security/2026/10/20/15
More from Apache CouchDB
9.8
CVE-2022-24706
Remote Code Execution Vulnerability in Packaging
9.3
CVE-2026-86471
Apache CouchDB: Admin credentials leading to code execution as operating system user
7.7
CVE-2026-90797
Apache CouchDB: Pre-authentication gzip decompression bomb via POST /_session
7.2
CVE-2018-11769
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S)
6.0
CVE-2026-107755
Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs