CVE-2026-90910None▾ SunlitMissing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reactio…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Missing authentication for critical function vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
apache_answer <= 2.0.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-67249NoneApache Answer: Email Code Purpose Confusion May Allow Account Takeover
CVE-2026-108771NoneApache Kylin: unauthenticated broadcast API and polymorphic deserialization
CVE-2026-64943NoneApache Answer: API keys logged in plaintext during authentication
CVE-2026-64945NoneApache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
CVE-2026-64944NoneApache Answer: Stored XSS via unsanitized HTML in imported question content
CVE-2026-79624NoneApache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation