As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content
Apache Answer through version 2.0.2 contains an authorization bypass in its reaction application programming interface (API) that fails to enforce content visibility controls. Unauthorized users can read reaction metadata from restricted content and add or remove their own reactions. The vendor recommends upgrading to version 2.0.3.
Why it matters: Organizations using Apache Answer 2.0.2 or earlier should upgrade immediately to patch this moderate-severity authorization flaw that exposes restricted content metadata and allows unauthorized reaction manipulation.
- Source published
- First seen by Cybersecurity Tracker