Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-90910: Apache Answer lets unauthorized users see and change reactions
CVE-2026-90910 · published 12 days ago
Summary
The reaction feature in Apache Answer does not check who can view or modify reactions, so people without permission can read reaction details on hidden items or add and delete their own reactions. This could expose internal feedback or let unwanted activity appear on restricted content. Update the software to version 2.0.3 to fix the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| apache software foundation | apache answer | <= 2.0.2 |
Original advisory text
Apache Answer: Reaction API authorization bypass for restricted content
Missing authentication for critical function vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
This issue affects Apache Answer: through 2.0.2.
The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-306Missing Authentication for Critical Function
Timeline
Published19 Oct 2026
Updated30 Oct 2026
First seen19 Oct 2026
Track software like this
Free during beta