PT-2026-132422

Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed user or replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to...

PT-2026-118487

Name of the Vulnerable Software and Affected Versions Apache CouchDB versions prior to 3.5.3 Description Missing authorization checks in chttpd allow any request to read the full contents of a prefixed user or replicator database via an unauthorized API endpoint. Recommendations Upgrade to versio...