Live › vulnerability › CVE-2026-90800
Go to dashboardApache CouchDB 3.5.2 and earlier lack authorisation checks in its chttpd HTTP layer. A request to an unauthorised API endpoint can read the full contents of a prefixed _users or _replicator database.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only deployments that use prefixed system databases, meaning a _users or _replicator database with a prefix in its name, are exposed. The sources describe this setup as very rare. Installations that use the default unprefixed system databases are not described as affected, and the sources do not say whether they are safe.
No product ranges from the sources yet.
curl http://localhost:5984/ and look at the version field.curl http://localhost:5984/_all_dbs and looking for names ending in _users or _replicator.3.5.3.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.
The use of prefixed system databases is very rare.
Users are recommended to upgrade to version 3.5.3, which fixes this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-90800")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.