BIT-couchdb-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases

Q: Which deployments are realistically exposed to this issue?

Apache CouchDB deployments running version 3.5.2 or earlier are affected if they use prefixed _users or _replicator system databases. The described configuration is very rare.

Q: Does exploitation require authentication or user interaction?

No. The issue allows any request to read the full contents of an affected prefixed system database through an unauthorised API endpoint, so no authentication or user interaction is indicated.

Q: What should be done to remediate the issue?

Upgrade Apache CouchDB to version 3.5.3, which fixes the missing authorization checks.

Q: How can I determine whether my deployment may be affected?

Check whether the CouchDB instance is version 3.5.2 or earlier and whether it uses prefixed _users or _replicator databases. If both conditions apply, the affected database contents may be readable through the unauthorised endpoint.

Published Oct 29, 2026

Updated

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or replicator database via an unauthorised API endpoint.

The use of prefixed system databases is very rare.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Affected Software

1 affected componentFixes available

bitnami/couchdb<3.5.3

3.5.3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade bitnami/couchdb to a version that resolves this vulnerability.
Fixed in 3.5.3
Upgrade
Upgrade Apache CouchDB to a version that resolves this vulnerability.
Fixed in 3.5.3

Event History

Oct 29, 2026

Advisory Published

via OSV·08:39 AM

Data Sourced

via OSV·08:39 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

Apache CouchDB deployments running version 3.5.2 or earlier are affected if they use prefixed _users or _replicator system databases. The described configuration is very rare.

Does exploitation require authentication or user interaction?

No. The issue allows any request to read the full contents of an affected prefixed system database through an unauthorised API endpoint, so no authentication or user interaction is indicated.

What should be done to remediate the issue?

Upgrade Apache CouchDB to version 3.5.3, which fixes the missing authorization checks.

How can I determine whether my deployment may be affected?

Check whether the CouchDB instance is version 3.5.2 or earlier and whether it uses prefixed _users or _replicator databases. If both conditions apply, the affected database contents may be readable through the unauthorised endpoint.

BIT-couchdb-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

Does exploitation require authentication or user interaction?

What should be done to remediate the issue?

How can I determine whether my deployment may be affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are realistically exposed to this issue?

Does exploitation require authentication or user interaction?

What should be done to remediate the issue?

How can I determine whether my deployment may be affected?