HIGH 8.1 NVD
CVE-2026-90800
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _r
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.
The use of prefixed system databases is very rare.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
References
- https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f
- https://lists.apache.org/thread/vng8vqjwgy1qlrv14wzrgs7pv4gj7gwr
- https://www.openwall.com/lists/oss-security/2026/10/20/15
This high severity vulnerability with a CVSS score of 8.1 was published on 2026-10-20 via NVD.
vulnfeed aggregates 16920 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.