Apache CouchDB EUVD-2026-105100

Exploitation requires the target CouchDB instance (3.5.2 or earlier) to be configured with PREFIXED system databases - i.e. a prefixed _users or _replicator database - which the vendor explicitly describes as 'very rare.' Standard deployments using the default (non-prefixed) system databases are NOT exploitable. The attacker needs network reach to the chttpd HTTP API; per the CVSS vector (PR:N) no authentication is required once the prefixed-database condition is met, and no user interaction is needed. The dominant limiting factor is this non-default configuration (reflected as AT:P in the CVSS 4.0 vector), which drastically narrows the exploitable population despite the network/unauthenticated vector.

This is a genuine but situationally-limited information-disclosure flaw, best characterized as a high-CVSS issue with low real-world exploitation likelihood for most deployments. The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated read against CouchDB's chttpd layer, which on its face is serious. However, the vector critically includes AT:P (attack requirements present), and the vendor description makes the prerequisite explicit and self-limiting: exploitation only works against *prefixed* system databases (prefixed _users or _replicator), a configuration the vendor states is 'very rare.' Exploitation status is benign: the vector carries E:U (exploit unproven), there is no CISA KEV listing and no POC, so this is 'no public exploit identified at time of analysis.' No EPSS score was provided. One conflict to flag: the input CVSS 4.0 asserts VI:H and SI:H (high integrity impact to both vulnerable and subsequent systems), yet the description describes only unauthorised *reading* of database contents - a pure confidentiality issue - with no mention of write/modify capability; this integrity rating is not substantiated by the description and should be verified against the Apache advisory. Net priority: low-to-moderate for the general CouchDB population (standard non-prefixed system databases are unaffected), elevating to high only for the rare operators who have deliberately configured prefixed system databases.

An organisation runs Apache CouchDB 3.5.2 or earlier with the uncommon prefixed system-database configuration exposed to a network. An unauthenticated attacker who can reach the HTTP API sends crafted requests to the vulnerable chttpd endpoint and retrieves the complete contents of a prefixed _users or _replicator database - potentially exposing user documents, credentials hashes, and replication targets/credentials. No public exploit code is known, so an attacker would need to reconstruct the request path from the advisory.