CVE-2026-90910
Missing authentication for critical function vulnerability in Apache Answer. This issue affects…
- Risk score
- 74/100
- CVSS
- 9.8 v3.1
- Exploit chance (30 days)
- 0.6%
- Published
- 19 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A missing authentication vulnerability in Apache Answer allows unauthorized users to read reaction metadata or add/remove reactions. An attacker could exploit this to gain high privileges.
- Affected
- {'products': ['Apache Answer'], 'packages': [], 'versions': ['through 2.0.2']}
- Fix
- Upgrade to version 2.0.3
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 9.8 critical
- Remotely exploitable without logging in
References
Original description
Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Last activity 19 Oct 2026. Patch Forecast updates every hour.