Insufficient filtering of credentials in the _replicator database lets a logged‑in operator read replication credentials that belong to other users. This exposure can allow the attacker to compromise the confidentiality of replication connections and potentially use those credentials to pivot into other services or databases that are replicated with the disclosed credentials.

The vulnerability affects Apache CouchDB version 3.5.2 and all earlier releases on every supported platform, regardless of operating system.

The CVSS score of 6.0 indicates moderate severity. EPSS information is unavailable, so the risk of exploitation is uncertain but could be considered low to moderate. The issue is not listed in CISA’s KEV catalog. An attacker must first authenticate to a CouchDB instance and then query the _replicator database; the attack does not require remote network exploitation beyond sending authenticated requests to the service.