Apache Answer: Authorization bypass in reaction API for restricted content

Summary

Apache Answer, an open-source Q&A and community platform, does not enforce content visibility controls in its reaction API. An unauthenticated attacker can read reaction metadata from restricted content and add or remove their own reactions. The vendor rates the CVSS 3.1 score as 9.8, but the described impact appears narrower, so the score should be treated as provisional until NVD or the Apache advisory confirms it.

Affected

• Apache Answer through 2.0.2

Fixed in

• Apache Answer 2.0.3

Workaround

• Unknown. The vendor does not describe a workaround; upgrading to 2.0.3 is the fix.
• Restrict external access to the instance or place it behind authentication where the forum does not need to be public.

Exploitation

• CISA KEV: not listed.
• CISA SSVC: exploitation none, automatable yes, technical impact total.
• No public proof of concept or report of in-the-wild exploitation found.

Our recommendation

• Inventory all Apache Answer instances and their versions; flag internet-facing ones.
• Upgrade to Apache Answer 2.0.3 or later as soon as possible. This release also contains other security fixes.
• Until patched, limit exposure and review web logs for unauthenticated calls to the reaction API.
• Recheck NVD and the Apache advisory for final scoring and exploitation updates.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Apache mailing list thread lists.apache.org
• oss-security post CVE-2026-90910 www.openwall.com
• OpenCVE CVE-2026-90910 app.opencve.io
• Strix CVE-2026-90910 www.strix.ai
• OffSeq radar CVE-2026-90910 radar.offseq.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:28.