CVE-2026-90910: apache software foundation apache answer

CVSS: 9.8v3.1CriticalAwaiting analysis

Published 19-10-2026Last modified 19-10-2026

Open JSON

Vulnerability summary

CVE-2026-90910 is a critical (CVSS 9.8) vulnerability in apache software foundation apache answer.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (CVE.org)

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Timeline

19-10-2026
PublishedVulnerability first disclosed.
19-10-2026
Last modifiedVulnerability information updated.

Description

Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

CVSS metrics

2 scores · 2 sources · 1 version

v3.19.8

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Affected systems

Apache software foundation1 product

apache answer≤ 2.0.2

1 vendor · 1 product

References

2 links