CVE-2026-90800
Deferred Deferred - Pending Action

Unauthorised Database Access in Apache CouchDB

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: Apache Software Foundation

Description
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-11-09
AI Q&A
2026-10-20
EPSS Evaluated
2026-11-08
NVD
CVE-2026-90800
EUVD
EUVD-2026-105100

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache CouchDB 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Missing authorization checks in chttpd in Apache CouchDB 3.5.2 and below allow any request to read the full contents of a prefixed _user or _replicator database via an unauthorized API endpoint. The use of prefixed system databases is very rare.

Detection Guidance

Check Apache CouchDB version with curl http://localhost:5984/ or via package manager. Inspect logs for unauthorized access to _user or _replicator databases. Test endpoints like /_users/_all_docs or /_replicator/_all_docs for data exposure.

Impact Analysis

An attacker could exploit this to access sensitive data stored in _user or _replicator databases, potentially exposing user credentials or replication settings. This could lead to unauthorized access or data breaches.

Compliance Impact

This vulnerability could result in unauthorized data access, violating GDPR's data protection principles or HIPAA's confidentiality requirements. Organizations may face compliance penalties or legal consequences.

Mitigation Strategies

Upgrade Apache CouchDB to version 3.5.3 or later immediately. Restrict network access to CouchDB ports (5984 by default) using firewalls. Monitor for unusual database queries or data exfiltration attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90800. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...