Missing Authentication for Critical Function in Apache Answer - CVE-2026-90910
Published: October 23, 2026
Vulnerability identifier: #VU157279
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90910
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to read reaction metadata associated with restricted content and add or remove their own reactions without authorization.
The vulnerability exists due to missing authentication for critical functionality in the Apache Answer reaction API when handling requests involving restricted content. A remote attacker can submit requests that bypass content visibility controls to retrieve reaction metadata or add and remove their own reactions on content they are not authorized to access.
Affected software
Apache Answer
How to mitigate CVE-2026-90910
Install security update from vendor's website.
Apache Answer - update to 2.0.3