CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content
Apache Answer through 2.0.2 lets unauthorized users read or change reaction metadata on restricted content.
42
Product
Apache Answer
- Mentions · 7d0
- Mentions · 30d13
- All mentions13
- First seenOct 16, 2026
- Last mentioned14d ago
Timeline
13 articles · newest firstCVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
Apache Answer User Center sessions can ignore central account suspension or deletion until they expire.
40
CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
Apache Answer through 2.0.2 let authenticated users modify non-public content they should not access.
42
CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
Revoked Apache Answer sessions kept access to private uploads via stale visit tokens through 2.0.2.
41
CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
Apache Answer through 2.0.2 lets authenticated users view metadata of non-public questions.
32
CVE-2026-79613: Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
Moderate Apache Answer flaw can expose comments on non-public content via public profiles.
28
CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
Unauthenticated users can pull hidden-question metadata from Apache Answer public profiles.
36
CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
Apache Answer through 2.0.2 lets global API keys read answers on non-public questions.
38
CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup
Apache Answer through 2.0.2 leaks invited-user lists for non-public questions.
28
CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
Apache Answer email-code confusion through 2.0.2 may allow account takeover.
46
CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
Apache Answer through 2.0.2 lets unpin-only users hide or show questions.
24
CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content
Apache Answer through 2.0.2 stores imported question HTML unsanitized, enabling stored cross-site scripting.
32
CVE-2026-64943: Apache Answer: API keys logged in plaintext during authentication
Apache Answer through 2.0.2 logs full API keys in plaintext; 2.0.3 stops the leak.
36
Related CVEs
by mentions- API keys written to logs in Apache Answer through 2.0.2
- A vulnerability in Apache Answer
- Incorrect implementation of authentication algorithm vulnerability in Apache Answer
- Missing Authorization vulnerability in Apache Answer
- Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer
- Insufficient session expiration vulnerability in Apache Answer
- A vulnerability in Apache Answer
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer
- vulnerability in Apache Answer
- vulnerability in Apache Answer
Appears with
- Apache Software Foundationorganization · 11
- Apachevendor · 7
- Apache Software Foundationvendor · 6
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.