{"id":"CVE-2026-90910","state":"PUBLISHED","title":"Apache Answer: Reaction API authorization bypass for restricted content","description":"Missing authentication for critical function vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nThe reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","publishedAt":"2026-10-19T09:35:54.679Z","updatedAt":"2026-10-19T18:50:42.533Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"CISA-ADP"},"assigner":"apache","products":["Apache Software Foundation Apache Answer"],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Answer","packageURL":"pkg:software-id/apache.org/answer","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.2","versionType":"semver"}]}],"references":["https://lists.apache.org/thread/bhw80mvmnt9206wyqz80rcbwx1znv1p3","http://www.openwall.com/lists/oss-security/2026/10/16/34"],"weaknesses":["CWE-306"],"ingestedAt":"2026-10-29T20:13:34.582Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/90xxx/CVE-2026-90910.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-90910","state":"PUBLISHED","datePublished":"2026-10-19T09:35:54.679Z","dateUpdated":"2026-10-19T18:50:42.533Z","assignerShortName":"apache","assignerOrgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateReserved":"2026-09-14T10:52:53.687Z"},"containers":{"cna":{"title":"Apache Answer: Reaction API authorization bypass for restricted content","descriptions":[{"lang":"en","value":"Missing authentication for critical function vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nThe reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."}],"affected":[{"vendor":"Apache Software Foundation","product":"Apache Answer","packageURL":"pkg:software-id/apache.org/answer","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.0.2","versionType":"semver"}]}],"references":[{"url":"https://lists.apache.org/thread/bhw80mvmnt9206wyqz80rcbwx1znv1p3","tags":["vendor-advisory"]}],"metrics":[{"other":{"type":"Textual description of severity","content":{"text":"moderate"}},"scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-306","description":"CWE-306 Missing authentication for critical function","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"apache","orgId":"f0158376-9dc2-43b6-827c-5f631a4d8d09","dateUpdated":"2026-10-19T09:39:10.136Z"},"source":{"discovery":"EXTERNAL"},"credits":[{"lang":"en","value":"Maksim Hayder","type":"reporter"}],"x_generator":{"engine":"Vulnogram 1.0.3"}},"adp":[{"title":"CVE Program Container","references":[{"url":"http://www.openwall.com/lists/oss-security/2026/10/16/34"}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2026-10-19T10:15:05.537Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"timestamp":"2026-10-19T18:50:33.766805Z","id":"CVE-2026-90910","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:50:42.533Z"}}]}}}