---
id: CVE-2026-90910
title: 'Apache Answer: Reaction API authorization bypass for restricted content'
summary: >-
  Missing authentication for critical function vulnerability in Apache Answer.




  This issue affects Apache Answer: through 2.0.2.




  The reaction API did not enforce content visibility controls, allowing
  unauthorized users to read reactio…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-306
vendor: Apache Software Foundation
product: Apache Answer
affected:
  - apache_answer <= 2.0.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-19T18:50:33.766805Z'
published: '2026-10-19'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T18:50:42.533Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-90910'
references:
  - url: 'https://lists.apache.org/thread/bhw80mvmnt9206wyqz80rcbwx1znv1p3'
tags:
  - cve.org
ingestedAt: '2026-10-19T12:27:23.822Z'
epss: 0.00479
epssPercentile: 0.41509
---

## Overview

Missing authentication for critical function vulnerability in Apache Answer.



This issue affects Apache Answer: through 2.0.2.



The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.



Users are recommended to upgrade to version 2.0.3, which fixes the issue.

## Affected

- `apache_answer <= 2.0.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.