CVE-2026-90800highCWE-862

CVE-2026-90800: falha de alta gravidade em Apache CouchDB

Apache CouchDB: Auth bypass in prefixed _users and _replicator databases

Publicada em

Seguir esta CVE+ Monitorar Apache CouchDB

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 8.1epss 0.6%
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/E:U/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
Produtos afetados
Apache Software Foundation · Apache CouchDB
CVEs relacionadas — Apache CouchDB

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24706CRITICALRemote Code Execution Vulnerability in PackagingEPSS 92.5%KEVCVE-2017-12635—CVE-2017-12635EPSS 99.8%CVE-2017-12636—CVE-2017-12636EPSS 90.6%CVE-2018-8007—CVE-2018-8007EPSS 12.2%CVE-2018-11769—CVE-2018-11769EPSS 8.4%CVE-2018-17188—CVE-2018-17188EPSS 3.6%