CVE-2019-11496

In versions of Couchbase Server prior to 5.0, the bucket named "default" was a special bucket that allowed read and write access without authentication. As part of 5.0, the behavior of all buckets including "default" were changed to only allow access by authenticated users with sufficient authorization. However, users were allowed unauthenticated and unauthorized access to the "default" bucket if the properties of this bucket were edited. This has been fixed in versions 5.1.0 and 5.5.0.

• CWE-306

• https://www.couchbase.com/resources/security#SecurityAlertsVendor Advisory
• https://www.couchbase.com/resources/security#SecurityAlertsVendor Advisory

Published

Sep 10, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-1149A remote code execution vulnerability exists when the Window…8.8
• CVE-2019-11490An issue was discovered in Npcap 0.992. Sending a malformed …
• CVE-2019-11492ProjectSend before r1070 writes user passwords to the server…
• CVE-2019-11493VeryPDF 4.1 has a Memory Overflow leading to Code Execution …
• CVE-2019-11494In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the sub…7.5
• CVE-2019-11495In Couchbase Server 5.1.1, the cookie used for intra-node co…9.8
• CVE-2019-11497In Couchbase Server 5.0.0, when an invalid Remote Cluster Ce…7.5
• CVE-2019-11498WavpackSetConfiguration64 in pack_utils.c in libwavpack.a in…6.5
• CVE-2019-11499In the IMAP Server in Dovecot 2.3.3 through 2.3.5.2, the sub…7.5
• CVE-2019-1150A remote code execution vulnerability exists when the Window…8.8
• CVE-2019-11500In Dovecot before 2.2.36.4 and 2.3.x before 2.3.7.2 (and Pig…
• CVE-2019-11502snap-confine in snapd before 2.38 incorrectly set the owners…