CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content
Published Oct 16, 2026
·Updated
Missing authentication for critical function vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected Software
1 affected component
Apache Answer<=2.0.2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Oct 19, 2026
CVE Published
via MITRE·09:35 AM
Data Sourced
via MITRE·09:35 AM
DescriptionWeakness
Data Sourced
via NVD·10:16 AM
DescriptionSeverityWeakness