---
id: "CVE-2026-90910"
kind: "vulnerability"
aliases: ["CVE-2026-90910"]
title: "Missing authentication for critical function vulnerability in Apache Answer"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["apache-answer", "package", "self-hosted"]
not_affected_if: ["version-2.0.3-or-later"]
published_at: "2026-10-19T10:16:49+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-23T22:28:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90910", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Missing authentication for critical function vulnerability in Apache Answer

Apache Answer, a Q&A platform, through version 2.0.2 has a reaction API that does not enforce content visibility controls. An unauthenticated attacker can read reaction metadata from restricted content and add or remove their own reactions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

Check the installed Apache Answer version in the deployment; versions through 2.0.2 are affected.

## Fix

Upgrade Apache Answer to version 2.0.3.

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90910

## From the sources

Missing authentication for critical function vulnerability in Apache Answer.



This issue affects Apache Answer: through 2.0.2.



The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.



Users are recommended to upgrade to version 2.0.3, which fixes the issue.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_