Live › vulnerability › CVE-2026-90910
Go to dashboardApache Answer, a Q&A platform, through version 2.0.2 has a reaction API that does not enforce content visibility controls. An unauthenticated attacker can read reaction metadata from restricted content and add or remove their own reactions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
No product ranges from the sources yet.
Check the installed Apache Answer version in the deployment; versions through 2.0.2 are affected.
Upgrade Apache Answer to version 2.0.3.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing authentication for critical function vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-90910")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.