{"id":"CVE-2023-26268","aliases":["BIT-couchdb-2023-26268","EUVD-2023-30092","GHSA-97qc-h8j3-mgv9","UBUNTU-CVE-2023-26268"],"status":"published","title":"Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes","description":"Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:\n  *  validate_doc_update\n\n  *  list\n\n  *  filter\n\n  *  filter views (using view functions as filters)\n\n  *  rewrite\n\n  *  update\n\n\n\nThis doesn't affect map/reduce or search (Dreyfus) index functions.\n\nUsers are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01429,"percentile":0.73344,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2023-05-02T20:06:09Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Bitnami","package":"couchdb","fixed_in":["3.2.3","3.3.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"couchdb","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"3.2.3"},{"introduced":"3.3.0"},{"fixed":"3.3.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"couchdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-0ubuntu7"]}],"products":[{"vendor":"apache","product":"couchdb"},{"vendor":"apache software foundation","product":"apache couchdb"},{"vendor":"apache software foundation","product":"ibm cloudant"},{"vendor":"ibm","product":"cloudant"}],"references":[{"url":"https://lists.apache.org/thread/r2wvjfysg3d92lhhjd1qh3wfr8mlp0pp","tags":["vendor-advisory","x_transferred","Mailing List","discussion","advisory","report"]},{"url":"https://docs.couchdb.org/en/stable/cve/2023-26268.html","tags":["release-notes","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.apache.org/thread/ldkqs0nhpmho26bdxf4fon7w75hsq5gl","tags":["vendor-advisory","x_transferred","Mailing List","discussion","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26268","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-97qc-h8j3-mgv9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26268.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-26268","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26268","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2023-26268","title":"Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes","description":"Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:\n  *  validate_doc_update\n\n  *  list\n\n  *  filter\n\n  *  filter views (using view functions as filters)\n\n  *  rewrite\n\n  *  update\n\n\n\nThis doesn't affect map/reduce or search (Dreyfus) index functions.\n\nUsers are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.\n\n","status":"published","published":"2023-05-02T20:06:09.352Z","modified":"2024-10-15T18:11:19.56Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-30092","description":"Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:\n  *  validate_doc_update\n\n  *  list\n\n  *  filter\n\n  *  filter views (using view functions as filters)\n\n  *  rewrite\n\n  *  update\n\n\n\nThis doesn't affect map/reduce or search (Dreyfus) index functions.\n\nUsers are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.\n\n","status":"published","published":"2023-05-02T20:06:09Z","modified":"2024-10-15T18:11:19Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:27:36.689661Z"}],"ghsa":[{"id":"GHSA-97qc-h8j3-mgv9","title":"Design documents with matching document IDs, from databases on the same cluster, may share a...","description":"Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:\n  *  validate_doc_update\n\n  *  list\n\n  *  filter\n\n  *  filter views (using view functions as filters)\n\n  *  rewrite\n\n  *  update\n\n\n\nThis doesn't affect map/reduce or search (Dreyfus) index functions.\n\nUsers are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.\n\n","status":"published","published":"2023-05-02T21:31:49Z","modified":"2024-04-04T03:46:54Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:56:18.00765Z"}],"nvd":[{"id":"CVE-2023-26268","description":"Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:\n  *  validate_doc_update\n\n  *  list\n\n  *  filter\n\n  *  filter views (using view functions as filters)\n\n  *  rewrite\n\n  *  update\n\n\n\nThis doesn't affect map/reduce or search (Dreyfus) index functions.\n\nUsers are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.\n\n","status":"published","published":"2023-05-02T21:15:09.233Z","modified":"2026-06-17T05:42:56.843Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:07:59.151142Z"}],"osv":[{"id":"CVE-2023-26268","title":"Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes","description":"Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:\n  *  validate_doc_update\n\n  *  list\n\n  *  filter\n\n  *  filter views (using view functions as filters)\n\n  *  rewrite\n\n  *  update\n\n\n\nThis doesn't affect map/reduce or search (Dreyfus) index functions.\n\nUsers are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.\n\n","status":"published","published":"2023-05-02T20:06:09.352Z","modified":"2026-10-28T02:30:36.317185264Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"UBUNTU-CVE-2023-26268","description":"Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:   *  validate_doc_update   *  list   *  filter   *  filter views (using view functions as filters)   *  rewrite   *  update This doesn't affect map/reduce or search (Dreyfus) index functions. Users are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3). Workaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.","status":"published","published":"2023-05-02T21:15:00Z","modified":"2025-10-24T05:01:51Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"BIT-couchdb-2023-26268","title":"Apache CouchDB, IBM Cloudant: Information sharing via couchjs processes","description":"Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions:\n  *  validate_doc_update\n\n  *  list\n\n  *  filter\n\n  *  filter views (using view functions as filters)\n\n  *  rewrite\n\n  *  update\n\n\n\nThis doesn't affect map/reduce or search (Dreyfus) index functions.\n\nUsers are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3).\n\nWorkaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.","status":"published","published":"2024-03-06T10:51:14.379Z","modified":"2026-09-08T08:46:03.196407401Z","updated_at":"2026-11-02T15:28:28.70813Z"}]}}