Read the docs
TI-2016-07199 Aliases CVE-2016-8742GHSA-gq4g-cfc7-fgw7

Access control flaw in Apache CouchDB

Priority LOW 38CWE-264Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-264.

Summary

The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation. All files in the install inherit the file permissions of the parent directory and therefore a non-privileged user can substitute any executable for the nssm.exe service launcher, or CouchDB batch or binary files. A subsequent service or server restart will then run that binary with administrator privilege. This issue affected CouchDB 2.0.0 (Windows platform only) and was addressed in CouchDB 2.0.0.1.

Why it matters now

EPSS 0.01961 80th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache CouchDB2.0.0 (Windows platform only)—No fix listedCNA
  • Apache CouchDB VendorApache Affected 2.0.0 (Windows platform only) Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:apache:couchdb:2.0.0:*:*:*:*:*:*:*2.0.0VulnerableApache
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:apache:couchdb:2.0.0:*:*:*:*:*:*:* Versions 2.0.0 Vulnerable ·Apache
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-8742
  2. 2026-10-03 Alias added: GHSA-gq4g-cfc7-fgw7

References

Exploit 1

Advisory 1

  • TI-2022-08521 Remote Code Execution Vulnerability in Packaging KEVCVSS 3.1CRITICAL 9.8
  • TI-2017-09360 Improper privilege management in Apache CouchDB CVSS 3.0CRITICAL 9.8
  • TI-2017-09361 OS command injection in Apache CouchDB CVSS 3.0HIGH 7.2
  • TI-2020-01879 Missing authentication in Apache CouchDB CVSS 3.1CRITICAL 9.8
  • TI-2018-05784 Improper input validation in Apache CouchDB CVSS 3.0HIGH 7.2
  • TI-2018-08426 CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S). CVSS 3.0HIGH 7.2
See all 19 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences