The vulnerability is a missing authorisation check in the chttpd component of Apache CouchDB versions 3.5.2 and earlier that allows any client to access the full contents of a prefixed _users or _replicator database through an unauthorised API endpoint. The lack of authentication for these endpoints means an attacker can obtain detailed user or replication configuration information, which may expose credentials, replication URLs, or other sensitive data, thereby violating confidentiality of the CouchDB instance.

Apache CouchDB 3.5.2 and any earlier release on any platform are affected. The issue specifically targets deployments that use prefixed system databases, a configuration that is uncommon but still possible. Systems running newer releases such as 3.5.3 or later are not impacted.

The CVSS score of 8.1 indicates a high severity vulnerability. No EPSS score is available, and the issue is not part of the CISA KEV catalog, but the existence of an unauthenticated API endpoint suggests a straightforward remote attack path. An attacker only needs network access to the CouchDB HTTP endpoint to read privileged data, with no additional authentication or privilege escalation required. The likelihood of exploitation will depend on exposure of the CouchDB instance to the open internet and the specific use of prefixed _users or _replicator databases.