CVE-2026-107755
MEDIUM 6Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
No known exploitation, public exploit, or elevated probability at this time. Track for changes.
Exploitation likelihood
0.6%chance of exploitation in 30 days · 48th percentile
Impact if exploited
6CVSS 4.0 · MEDIUM
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityLow
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
- ⚠Requirements: Specific conditions must be present
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
References and research data (JSON)
All CVSS metrics
- MEDIUM 6 v4.0 · CNA Primary
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/S:N/AU:Y/R:U/V:C/RE:M/U:Amber - MEDIUM 6 v4.0 · NVD Secondary
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:C/RE:M/U:Amber
References
Patches & mitigations
- https://lists.apache.org/thread.html/pj83174r8f8f64odf47fwhozbfjtot0f CVE record · apache · Updated 2026-10-20T15:41:22.248Z
NVD · CVE-2026-107755 · Updated 2026-10-20T19:34:00.700
Advisories
- https://lists.apache.org/thread/ro57p4r2lhxn2n4712ppx7r11oqq900n CVE record · apache · Updated 2026-10-20T15:41:22.248Z
NVD · CVE-2026-107755 · Updated 2026-10-20T19:34:00.700 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-105101 EUVD · EUVD-2026-105101
Technical & other
- http://www.openwall.com/lists/oss-security/2026/10/20/16CVE record · CVE · Updated 2026-10-20T18:09:53.132Z
NVD · CVE-2026-107755 · Updated 2026-10-20T19:34:00.700