Apache Answer CVSS 9.8 Bug Exposes Restricted Content

A critical missing authentication flaw in Apache Answer (CVE-2026-90910, CVSS 9.8) lets unauthenticated users read content the platform was supposed to restrict. Apache disclosed the vulnerability on October 19, 2026. All versions through 2.0.2 are affected.

The flaw sits in the reaction API. The endpoint skipped content visibility checks entirely, so any unauthenticated request could use it as a read path for restricted posts and threads. No authentication, no privileges, no user interaction: the CVSS 9.8 score reflects a network-level attack with nothing standing in the way.

What to do

Upgrade Apache Answer past 2.0.2. The Apache security announcement lists the patched release. If an immediate upgrade isn’t possible, restrict network access to the instance so only trusted, authenticated segments can reach it.

Who’s exposed

Apache Answer is Q&A software for teams: internal knowledge bases, support portals, documentation forums. If your deployment has content configured as restricted, this flaw would let anyone on the network read it without logging in. Check whether your instance is internet-facing before treating this as a low-priority upgrade.

The flaw does not require exploitation of any session or credential, which puts it in the same class as the recent Perforce P4 Search auth bypass and Fleet MDM auth bypass patches. Apache has had a rough run lately: Apache Roller patched a critical deserialization bug in September, and Apache Syncope closed seven critical flaws the same month. If you’re running other Apache Software Foundation projects, check your versions.