CVE-2026-107755

UNKNOWN 0.0

Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrade to version 3.5.3, which fixes this issue.

Vendor	apache software foundation
Product	apache couchdb
Published	Oct 20, 2026
Last Updated	Oct 20, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache couchdb

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache couchdb are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache CouchDB

0 < 3.5.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f lists.apache.org: https://lists.apache.org/thread/ro57p4r2lhxn2n4712ppx7r11oqq900n

Credits

🔍 Sakil Ahamed Gayen