Key points
- Apache Answer versions through 2.0.2 contain a missing authentication vulnerability in the reaction API.
- The flaw permits unauthorized users to read reaction metadata from restricted content.
- Attackers can also add or remove reactions on protected items without proper credentials.
Apache Answer versions up to 2.0.2 are affected by CVE-2026-90910, a moderate severity authorization bypass. The vulnerability exists within the reaction API, which fails to enforce content visibility controls. This allows unauthorized actors to interact with restricted data.
What happened
According to an advisory posted by Enxin Xie on the oss-security mailing list on 15 October, Apache Answer contains a missing authentication flaw. The issue specifically impacts the reaction API functionality within the software. The advisory states that the API did not enforce necessary content visibility controls.
This failure in authorization logic allows unauthorized users to read reaction metadata associated with restricted content. The vulnerability extends beyond read access, as attackers can also add or remove their own reactions on protected items. The flaw affects all versions of Apache Answer through 2.0.2.
Why it matters
The vulnerability is rated as moderate severity. It allows unauthorized users to bypass content visibility controls. Organizations using Apache Answer for restricted resources face potential data exposure. The flaw enables interaction with protected items without enforcing proper access rules.
The missing authentication on this critical function means the API does not verify user permissions. Attackers can exploit the flaw to view or modify reaction data. This bypasses standard access controls designed to protect restricted content from unauthorized viewing or editing.
What happens next
- Identify all instances of Apache Answer running versions 2.0.2 or earlier.
- Verify current installations against the affected version range.
- Plan an upgrade to version 2.0.3 to resolve the authorization bypass.
- Monitor logs for unusual reaction activity on restricted content.
- Review access logs for unauthorized API requests post-patch.
Patch priority
Teams usually prioritize systems exposed to untrusted networks first. Check whether public-facing instances are running vulnerable versions. Roll out updates after testing in isolated environments to ensure stability. Back up configuration files before applying changes. If immediate patching is not possible, restrict network access to the API endpoints. Monitor for anomalous traffic patterns that may indicate exploitation attempts.
What to do and how to stay safe: Apache Answer
- Audit your inventory for Apache Answer installations and check version numbers.
- Restrict network access to the reaction API endpoints if patching is delayed.
- Monitor server logs for unauthorized requests to the reaction API.
- Prepare to upgrade to version 2.0.3 once the vendor provides an update.
Step-by-step guide: Patch Management: Definition, Purpose and Operational Reality
General security guidance from the AppSec Scoop newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Apache Answer are affected by CVE-2026-90910?
All versions of Apache Answer through 2.0.2 are affected by this vulnerability.
Is there a fix available for this authorization bypass?
Yes, users are recommended to upgrade to version 2.0.3 to resolve the issue.
What can attackers do with this vulnerability?
Unauthorized users can read reaction metadata from restricted content and add or remove reactions.
