CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content
Apache Answer through 2.0.2 lets unauthorized users read or change reaction metadata on restricted content.
Apache disclosed CVE-2026-90910, a moderate missing-authentication flaw in Apache Answer through 2.0.2. The reaction API did not enforce content visibility controls, so unauthorized users could read reaction metadata on restricted content or add and remove their own reactions. Users are advised to upgrade to 2.0.3. No exploitation in the wild is reported.
- CVE-2026-90910 affects Apache Answer through 2.0.2.
- Reaction API skipped visibility checks on restricted content.
- Unauthorized users could read reaction metadata or add and remove their own reactions.
- Fixed in Apache Answer 2.0.3; Apache rates severity moderate.
- CVEs
- CVE-2026-90910
- Vendors
- Apache
- Products
- Apache Answer
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-90910 | Missing auth on Apache Answer reaction API through 2.0.2 | 9.8 | — |
From the original article
Posted by Enxin Xie on Oct 15 Severity: moderate Affected versions: - Apache Answer through 2. 0. 2 Description: Missing authentication for critical function vulnerability in Apache Answer.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.