{"id":"CVE-2026-90800","kind":"vulnerability","aliases":["CVE-2026-90800"],"related":[],"title":"CouchDB: missing auth checks let any request read prefixed _user databases","description":"Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint.\n\n\nThe use of prefixed system databases is very rare.\n\nUsers are recommended to upgrade to version 3.5.3, which fixes this issue.","summary":"Apache CouchDB 3.5.2 and earlier lack authorisation checks in its chttpd HTTP layer. A request to an unauthorised API endpoint can read the full contents of a prefixed _users or _replicator database.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["couchdb","package","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the running version with `curl http://localhost:5984/` and look at the `version` field.\n- Check whether any prefixed system databases exist, for example by listing all databases with `curl http://localhost:5984/_all_dbs` and looking for names ending in `_users` or `_replicator`.","fix":"- Upgrade Apache CouchDB to `3.5.3`.","status":"open","published_at":"2026-10-20T16:17:16+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T03:06:33+00:00","updated_at":"2026-10-25T03:06:33+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:06:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache CouchDB to `3.5.3`.","reach":"network","title":"CouchDB: missing auth checks let any request read prefixed _user databases","impact":"medium","summary":"Apache CouchDB 3.5.2 and earlier lack authorisation checks in its chttpd HTTP layer. A request to an unauthorised API endpoint can read the full contents of a prefixed _users or _replicator database.","category":"package","nicknames":[],"who_cares":["couchdb","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker reads full contents of prefixed user or replicator databases","analyst_note":"","how_to_check":"- Check the running version with `curl http://localhost:5984/` and look at the `version` field.\n- Check whether any prefixed system databases exist, for example by listing all databases with `curl http://localhost:5984/_all_dbs` and looking for names ending in `_users` or `_replicator`.","needs_analyst":false,"not_affected_if":["default-config"],"who_is_affected":"Only deployments that use prefixed system databases, meaning a _users or _replicator database with a prefix in its name, are exposed. The sources describe this setup as very rare. Installations that use the default unprefixed system databases are not described as affected, and the sources do not say whether they are safe.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000584,"input_tokens":3342,"output_tokens":500,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-90800':14A,17A '3.5.2':25B,63C '3.5.3':105C 'allow':69C 'apach':23B,61C 'api':41B,87C 'auth':3A 'authoris':29B,56C 'check':4A,30B,57C 'chttpd':33B,59C 'content':47B,76C 'couchdb':1A,18B,24B,62C 'cve':12A,15A 'databas':11A,54B,83C,94C 'earlier':27B 'endpoint':42B,88C 'fix':107C 'full':46B,75C 'host':22B 'http':34B 'issu':109C 'lack':28B 'layer':35B 'let':5A 'miss':2A,55C 'packag':19B 'platform':68C 'prefix':9A,50B,79C,92C 'rare':97C 'read':8A,44B,73C 'recommend':100C 'replic':53B,82C 'request':7A,37B,71C 'self':21B 'self-host':20B 'system':93C 'unauthoris':40B,86C 'upgrad':102C 'use':90C 'user':10A,51B,80C,98C 'version':104C 'via':84C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that use prefixed system databases, meaning a _users or _replicator database with a prefix in its name, are exposed. The sources describe this setup as very rare. Installations that use the default unprefixed system databases are not described as affected, and the sources do not say whether they are safe.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber","cvss_by":"security@apache.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90800","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90800","severity":null,"published_at":"2026-10-20T16:17:16+00:00","modified_at":"2026-10-20T19:34:00+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}