Key points
- CVE-2026-90800 affects Apache CouchDB versions 3.5.2 and earlier on all platforms.
- The flaw allows any request to read full contents of prefixed _user or _replicator databases.
- Apache Software Foundation recommends upgrading to version 3.5.3, which fixes the issue.
Apache CouchDB users running version 3.5.2 or any earlier release must update their systems immediately. The Apache Software Foundation has released version 3.5.3 to address a high-severity authorization bypass. This vulnerability allows unauthorized actors to access sensitive system databases without proper credentials.
In plain English
The flaw exists because the chttpd component fails to perform necessary authorization checks. An attacker can send a request to a specific API endpoint and read the entire contents of prefixed _user or _replicator databases. These databases store critical user and replication information. The National Vulnerability Database rates this issue as high severity with a CVSS score of 8.1.
The background
This vulnerability, tracked as CVE-2026-90800, affects all platforms where Apache CouchDB is installed. The National Vulnerability Database describes the weakness as missing authorization checks within the chttpd module. While the technical impact is significant, the source material notes that the use of prefixed system databases is very rare in typical deployments.
What changes now
A fix is available for those affected by this vulnerability. Users are recommended to upgrade to version 3.5.3 of Apache CouchDB. This update addresses the missing authorization checks that allowed the unauthorized API access. There is no mention of temporary workarounds or patches for older versions in the provided material.
Who needs to act first
Teams should prioritize updating systems that expose CouchDB to untrusted networks or the internet. Check whether your infrastructure uses prefixed system databases, as these are the primary targets for this specific flaw. Roll out the update in a staging environment first to verify compatibility with your applications. Back up your database configurations before applying the change. Monitor logs for any unusual access attempts during the transition period to ensure the fix is effective.
What to do and how to stay safe: Apache CouchDB
- Verify your current Apache CouchDB version and compare it against the affected range.
- Schedule an upgrade to version 3.5.3 for all affected instances as soon as possible.
- Review access logs for any unauthorized requests to _user or _replicator database endpoints.
- Restrict network access to CouchDB instances to trusted IP addresses until updates are applied.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Systems
General security guidance from the Patch Review newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Apache CouchDB are affected by CVE-2026-90800?
Apache CouchDB version 3.5.2 and all earlier versions are affected by this vulnerability.
Is there a fix available for this authorization bypass?
Yes, users are recommended to upgrade to version 3.5.3, which fixes this issue.
What is the severity rating of CVE-2026-90800?
The National Vulnerability Database rates this vulnerability as HIGH with a CVSS score of 8.1.
