Key points
- CVE-2026-90800 allows unauthorised reading of prefixed system databases via missing checks in chttpd.
- The flaw affects Apache CouchDB versions prior to 3.5.3 across all supported platforms.
- A patch is available in version 3.5.3, though the vulnerability impacts only rare prefixed database configurations.
Apache CouchDB version 3.5.3 addresses a high-severity authorisation bypass in the chttpd component. The update resolves CVE-2026-90800, which permitted unauthorised access to prefixed _user and _replicator databases in versions before 3.5.3.
What happened
A missing authorisation check in the chttpd module of Apache CouchDB versions prior to 3.5.3 allows any request to read the full contents of a prefixed _user or _replicator database. According to the National Vulnerability Database, this flaw exists on all platforms and is rated CVSS 8.1, which is classified as high severity. The vulnerability enables access via an unauthorised API endpoint without requiring authentication or user interaction.
Jan Lehnardt posted details to the oss-security mailing list, confirming the issue affects Apache CouchDB before version 3.5.3. The advisory notes that the use of prefixed system databases is very rare, limiting the practical exposure for most standard deployments. The flaw does not affect non-prefixed system databases or other database types within the platform.
Why it matters
Organisations running Apache CouchDB versions older than 3.5.3 with prefixed _user or _replicator databases face direct exposure to data leakage. The high CVSS score reflects the potential for significant confidentiality impact, as an attacker can read full database contents without credentials. While the configuration is uncommon, any instance using prefixed system databases is vulnerable until updated.
The absence of authorisation checks means that network access to the API endpoint is sufficient to exploit the flaw. Teams must verify whether their CouchDB instances utilise prefixed system databases, as standard installations may not be affected. Failure to update leaves these specific data stores open to unauthorised inspection by any entity with network reach.
What happens next
- Identify all Apache CouchDB instances running versions prior to 3.5.3 within the environment.
- Audit configurations to determine if any _user or _replicator databases are prefixed.
- Plan an upgrade to version 3.5.3 for affected systems during a maintenance window.
- Monitor network logs for unauthorised API requests to these specific database endpoints.
Patch priority
Teams should prioritise updating systems that expose prefixed system databases to untrusted networks. Verify whether any production instances use the rare prefixed configuration for _user or _replicator databases before scheduling the upgrade. If immediate patching is not feasible, restrict network access to the chttpd API endpoints to trusted sources only. Back up current database states before applying the update to ensure rollback capability. Test the upgrade in a staging environment to confirm compatibility with existing replication and user management workflows.
What to do and how to stay safe: Apache CouchDB
- Inventory all Apache CouchDB installations to confirm their current version numbers and compare them against the affected range.
- Review database configurations to identify any instances using prefixed _user or _replicator system databases.
- Restrict network access to CouchDB API endpoints to prevent unauthorised external requests while preparing for the update.
- Apply version 3.5.3 to all affected systems once testing confirms stability and compatibility with your specific deployment.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Apache CouchDB versions are affected by CVE-2026-90800?
All versions of Apache CouchDB prior to 3.5.3 are affected by this authorisation bypass vulnerability.
Is there a fix available for this vulnerability?
Yes, users are recommended to upgrade to version 3.5.3, which fixes the missing authorisation checks in chttpd.
Does this flaw affect all CouchDB databases?
No, the vulnerability specifically allows reading of prefixed _user or _replicator databases; standard non-prefixed databases are not mentioned as affected.
