CVE-2026-90800
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Oct 20, 2026
Vendor
unknown
Description
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.