CVE-2026-90910
Received Received - Intake

Missing Authentication in Apache Answer Allows Unauthorized Reaction Access

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-90910
EUVD
EUVD-2026-104165

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Answer 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a missing authentication for critical function issue in Apache Answer versions up to 2.0.2. The reaction API fails to enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or modify their own reactions.

Detection Guidance

This vulnerability involves missing authentication for critical functions in Apache Answer. To detect it, check if your Apache Answer instance is running version 2.0.2 or earlier. Verify if unauthorized users can access reaction metadata or modify reactions on restricted content. Inspect API logs for unusual reaction-related requests or responses.

Impact Analysis

Unauthorized users could access sensitive reaction metadata from restricted content or manipulate their own reactions, potentially exposing private information or altering content visibility without permission.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to reaction metadata from restricted content. Unauthorized data exposure may violate principles of data minimization and user consent under GDPR, while unauthorized access to sensitive metadata could affect HIPAA compliance if protected health information is involved.

Mitigation Strategies

Upgrade Apache Answer to version 2.0.3 or later to fix the missing authentication issue in the reaction API.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90910. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart