PT-2026-117322
CVE-2026-90910
·
Published
2026-10-19
·
Updated
2026-10-20
Description by
CVSS 3.1
9.8
CriticalMetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Apache Answer versions prior to 2.0.3
Description
An authentication bypass exists in the reaction API endpoint. The system fails to enforce content visibility controls, which allows unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.
Recommendations
Upgrade to version 2.0.3.
Found an issue in the description? Have something to add? Feel free to write us 👾