CVE-2026-90800

8.1High

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality, integrity
Weakness: CWE-862

Impact

Unauthenticated remote attackers can read the full contents of prefixed _user or _replicator system databases. They only need network access to the CouchDB chttpd API endpoint.

Root cause

The chttpd component lacks authorization checks on API endpoints handling prefixed system databases.

Affected systems

Apache CouchDB 3.5.2 and below on all platforms

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

Fix & remediation

Upgrade to Apache CouchDB 3.5.3. If patching must wait, restrict external network access to CouchDB API endpoints or ensure prefixed _user and _replicator databases are not configured.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade couchdb

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-90800