CVE-2026-90800

Published: Oct 20, 2026Modified: Oct 20, 2026Deferred

8.1

Vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:AmberShow less

Source: security@apache.org (Secondary)

Description

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (3)

https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f

Source: security@apache.org

https://lists.apache.org/thread/vng8vqjwgy1qlrv14wzrgs7pv4gj7gwr

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2026/10/20/15

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.