CVE-2026-90800: Apache CouchDB: Auth bypass in prefixed _users and _replicator databases
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or replicator database via an unauthorised API endpoint.
The use of prefixed system databases is very rare.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache CouchDBto a version that resolves this vulnerability.Fixed in 3.5.3
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Apache CouchDB deployments running version 3.5.2 or below are affected only where prefixed _user or _replicator system databases are in use. The advisory notes that use of these prefixed system databases is very rare.
Does exploitation require authentication or user interaction?
No. The issue is reachable through an unauthorised API endpoint, allowing any request to read the full contents of an affected prefixed system database.
What should teams do to remediate the issue?
Upgrade Apache CouchDB to version 3.5.3, which fixes the missing authorisation checks.