Loading vulnerability…
Authorization bypass in Apache CouchDB chttpd
CVE-2026-90800 is a missing-authorization vulnerability in the chttpd component of Apache CouchDB 3.5.2 and earlier on all platforms. An API endpoint lacks authorization checks for prefixed user and replication system databases, allowing unauthenticated requests to read their full contents. Only deployments using these rarely configured prefixed system databases are affected by this disclosure. Apache CouchDB 3.5.3 fixes the vulnerability.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An unauthenticated remote attacker can disclose the full contents of affected prefixed user or replication system databases, bypassing their access restrictions. The demonstrated impact is loss of confidentiality; database modification, code execution, and service disruption are not established by the vulnerability description.
If you can’t patch tonight, do this now.
No interim mitigation or workaround is specified.
Patch, then assume compromise.
Upgrade Apache CouchDB to version 3.5.3, which includes the authorization-check fix. For the Ubuntu 16.04 LTS package condition identified as unpatched, no distribution-provided solution is identified; remediation requires moving to a deployment that includes the upstream fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.