CVE-2026-90910

Published: Oct 19, 2026Modified: Oct 19, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Related CWEs

CWE-306

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (2)

https://lists.apache.org/thread/bhw80mvmnt9206wyqz80rcbwx1znv1p3

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2026/10/16/34

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.