Authentication Bypass Vulnerability in Apache Answer by Apache

CVE-2026-90910

What is CVE-2026-90910?

A vulnerability in Apache Answer allows unauthorized access due to missing authentication for critical functions. Specifically, the reaction API does not enforce proper content visibility controls. This flaw enables unauthorized users to access reaction metadata associated with restricted content, as well as to add or remove their own reactions. Users are strongly advised to update to version 2.0.3, which addresses this critical issue.

References