CVE-2026-90910: Apache Answer up to 2.0.2 lets unauthorized users access restricted content via reactions API
Moderate-severity advisory: the reactions API in Apache Answer up to version 2.0.2 did not enforce visibility controls. Version 2.0.3 fixes the issue.
Advisory CVE-2026-90910, rated moderate severity, was published on the oss-sec list on 15 October and appeared in a feed on 16 October 2026. It affects Apache Answer up to version 2.0.2. The reactions API did not enforce content visibility controls: unauthorized users could read reaction metadata on restricted content and also add or remove their own reactions. The advisory classifies the case as missing authentication for a critical function. The fix is in version 2.0.3, and the advisory recommends upgrading.
The source text is an automatic translation of a public advisory. To confirm details, consult the 2026 oss-sec list entry from the fourth quarter and the CVE identifier in public vulnerability databases. Check the original advisory before acting.