CVE-2026-107755CWE-200information-disclosure

CVE-2026-107755

published October 20, 2026

CVSS
6.0
EPSS
1%
Percentile
47.8
In the wild
Unconfirmed
What it is

Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

The record
Technical detail
CVSS
6.0 · NONE
CVSS v4.0
6.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
EPSS
0.00594 · 47.8th percentile
Weakness
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published
2026-10-20T20:16Z
References (3)
https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f · [email protected]https://lists.apache.org/thread/ro57p4r2lhxn2n4712ppx7r11oqq900n · [email protected]http://www.openwall.com/lists/oss-security/2026/10/20/16 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 22 OCT 03:28Z
    EPSS moved — → 1%
    epss
  • 20 OCT 15:41Z
    Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
    cvelistv5
  • 20 OCT 15:41Z
    Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form Replication Endpoint URLs
    cvelistv5