{"id":"CVE-2026-90910","kind":"vulnerability","aliases":["CVE-2026-90910"],"related":[],"title":"Missing authentication for critical function vulnerability in Apache Answer","description":"Missing authentication for critical function vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nThe reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","summary":"Apache Answer, a Q&A platform, through version 2.0.2 has a reaction API that does not enforce content visibility controls. An unauthenticated attacker can read reaction metadata from restricted content and add or remove their own reactions.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-answer","package","self-hosted"],"not_affected_if":["version-2.0.3-or-later"],"how_to_check":"Check the installed Apache Answer version in the deployment; versions through 2.0.2 are affected.","fix":"Upgrade Apache Answer to version 2.0.3.","status":"open","published_at":"2026-10-19T10:16:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-23T22:04:44+00:00","updated_at":"2026-10-23T22:28:56+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:04:44Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Apache Answer to version 2.0.3.","reach":"internet","impact":"low","summary":"Apache Answer, a Q&A platform, through version 2.0.2 has a reaction API that does not enforce content visibility controls. An unauthenticated attacker can read reaction metadata from restricted content and add or remove their own reactions.","category":"package","who_cares":["apache-answer","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attackers read reaction data on restricted posts and alter their own reactions.","analyst_note":"","how_to_check":"Check the installed Apache Answer version in the deployment; versions through 2.0.2 are affected.","needs_analyst":false,"not_affected_if":["version-2.0.3-or-later"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000435,"input_tokens":2787,"output_tokens":313,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-90910':12A,15A '2.0.2':31B,75C '2.0.3':109C 'add':54B,96C 'affect':71C 'allow':85C 'answer':9A,18B,24B,68C,73C 'apach':8A,17B,23B,67C,72C 'apache-answ':16B 'api':35B,78C 'attack':45B 'authent':2A,61C 'content':40B,52B,82C,94C 'control':42B,84C 'critic':4A,63C 'cve':10A,13A 'enforc':39B,81C 'fix':111C 'function':5A,64C 'host':22B 'issu':70C,113C 'metadata':49B,91C 'miss':1A,60C 'packag':19B 'platform':28B 'q':26B 'reaction':34B,48B,59B,77C,90C,101C 'read':47B,89C 'recommend':104C 'remov':56B,98C 'restrict':51B,93C 'self':21B 'self-host':20B 'unauthent':44B 'unauthor':86C 'upgrad':106C 'user':87C,102C 'version':30B,108C 'visibl':41B,83C 'vulner':6A,65C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-90910","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90910","severity":null,"published_at":"2026-10-19T10:16:49+00:00","modified_at":"2026-10-19T20:45:51+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}