CVE-2017-12635

CVE-2017-12635 is a critical privilege escalation vulnerability affecting Apache CouchDB versions before 1.7.0 and 2.x before 2.1.1. It arises from a JSON parser discrepancy that allows non-admin users to assign themselves administrative privileges by submitting _users documents with duplicate 'roles' keys. This vulnerability has a CVSS score of 9.8 (Critical) due to its network-exploitable nature, low attack complexity, and potential for complete compromise of confidentiality, integrity, and availability. While not listed on CISA's KEV catalog, exploit modules are publicly available in Metasploit and Nuclei, and it has garnered significant community discussion and media coverage, indicating a high likelihood of exploitation.