2.22. CVE-2026-90800: Auth bypass in prefixed Apache CouchDB _users and _replicator databases

Date:

12.10.2026

Affected:

3.5.2 and below

Severity:

High

Vendor:

The Apache Software Foundation

2.22.1. Description

CouchDB supports multiple instances of the system databases _users and _replicator. They are differentiated with a prefix, for example /foo/_users or /bar/_replicator. These databases behave exactly like the base system databases, but allow bespoke access control for their contents.

The restriction of allowing only server and database admins to use the _all_docs and _changes API endpoints on those prefixed system databases was not enforced.

2.22.2. Mitigation

The admin-only restriction is now enforced.

2.22.3. Workarounds

N/A

2.22.4. Credit

Qing Xu & ZeroVuln Labs reported this issue independently.