{"id":"CVE-2019-11496","url":"https://www.cyber-defence.io/tools/cve/CVE-2019-11496","generatedAt":"2026-10-28T22:21:55.624Z","title":"In versions of Couchbase Server prior to 5.0, the bucket named \"default\" was a special bucket that allowed read and write access without authentication.","description":"In versions of Couchbase Server prior to 5.0, the bucket named \"default\" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including \"default\" were changed to only allow access by authenticated users with sufficient authorization. However, users were allowed unauthenticated and unauthorized access to the \"default\" bucket if the properties of this bucket were edited. This has been fixed in versions 5.1.0 and 5.5.0.","published":"2019-09-10T18:15:13.000Z","lastModified":"2026-06-17T02:13:01.000Z","status":"Modified","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"cwe":["CWE-306"],"affected":["couchbase/couchbase server"],"epss":{"score":0.0141,"percentile":0.7251,"date":"2026-10-27","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (1.41%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://www.couchbase.com/resources/security#SecurityAlerts","tags":["Vendor Advisory"],"source":"cve@mitre.org"},{"url":"https://www.couchbase.com/resources/security#SecurityAlerts","tags":["Vendor Advisory"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2019-11496","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}