---
id: CVE-2026-107755
title: >-
  Apache CouchDB: Credential Disclosure to Non-Owner Members via Object-Form
  Replication Endpoint URLs
summary: >-
  Insufficient filtering of credentials in the _replicator database in Apache
  CouchDB 3.5.2 and below on all platforms allows an authenticated user to read
  replication credentials of other users’ replications, not just their own.


  Users ar…
severity: medium
cvss: 6
cvssVector: >-
  CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
cvssSource: cna
vendor: Apache Software Foundation
product: Apache CouchDB
affected:
  - apache_couchdb < 3.5.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-20T16:53:32.926065Z'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T18:09:53.132Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107755'
references:
  - url: 'https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f'
  - url: 'https://lists.apache.org/thread/ro57p4r2lhxn2n4712ppx7r11oqq900n'
tags:
  - cve.org
ingestedAt: '2026-10-20T16:10:53.296Z'
---

## Overview

Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own.

Users are recommended to upgrade to version 3.5.3, which fixes this issue.

## Affected

- `apache_couchdb < 3.5.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.