Patch CouchDB 3.5.2 to Block Unauthorized Access to Prefixed System Databases

Apache CouchDB users running versions before 3.5.3 face exposure to a high-severity authorization bypass that allows attackers to read sensitive system database contents. The vulnerability, tracked as CVE-2026-90800, stems from missing authorization checks within the chttpd component. According to the National Vulnerability Database, this flaw permits any request to access the full data of prefixed _user or _replicator databases through an unauthorized API endpoint.

The risk

The National Vulnerability Database assigns CVE-2026-90800 a CVSS 4.0 base score of 8.1, classifying it as high severity. The vector string indicates network accessibility and low complexity for attackers, though it requires a specific target condition. Jan Lehnardt posted the official advisory on October 20 via the oss-security mailing list. The flaw resides in the chttpd module of Apache CouchDB 3.5.2 and earlier releases.

Who is exposed

Any organization running Apache CouchDB versions prior to 3.5.3 is technically affected by this vulnerability across all platforms. However, the practical risk is limited to environments that utilize prefixed system databases. According to the official advisory, the use of prefixed _user or _replicator databases is very rare. Most standard deployments do not employ this configuration, reducing the immediate attack surface for the majority of users.

Cost and compliance

The source material does not provide specific financial cost estimates or regulatory compliance impacts for this vulnerability. The advisory focuses on the technical nature of the authorization bypass and the recommended remediation path. Organizations must evaluate their own compliance frameworks to determine if unauthorized access to user or replicator database contents violates specific data protection mandates.

Our take on the response

Security teams should prioritize upgrading to Apache CouchDB 3.5.3 to eliminate this authorization bypass. While the prevalence of prefixed system databases is low, the ease of exploitation makes patching essential for any instance running vulnerable versions. Monitoring for unusual API access patterns remains a prudent defensive measure until the update is deployed across all environments.

What defenders should look for

Teams usually monitor web server logs for unauthorized access attempts to administrative endpoints. Look for successful GET requests to user or replicator database paths from unauthenticated sources or unexpected IP addresses. Check whether application logs show reads of sensitive system data without corresponding authentication headers. Isolate affected instances immediately if suspicious activity is detected. Review firewall rules to restrict access to management interfaces. Validate that only authorized personnel can query system databases.

What to do and how to stay safe: Apache CouchDB

• Upgrade all instances of Apache CouchDB to version 3.5.3 or later to apply the vendor-provided fix.
• Audit current deployments to identify if any prefixed _user or _replicator databases are in use.
• Review web server access logs for unauthorized requests to system database API endpoints.
• Restrict network access to CouchDB management interfaces to trusted internal subnets only.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which Apache CouchDB versions are affected by CVE-2026-90800?

All versions of Apache CouchDB before 3.5.3 are affected by this vulnerability.

What is the CVSS score for this authorization bypass?

The National Vulnerability Database rates CVE-2026-90800 with a CVSS score of 8.1.

Is there a patch available for this issue?

Yes, users are recommended to upgrade to version 3.5.3, which fixes this issue.