Apache Answer Missing Auth on Reaction API
Apache Answer through 2.0.2 leaves its reaction API unauthenticated, letting any user read restricted content. CVSS 9.8 critical.
- Vendor
- Apache Software Foundation
- Product
- Apache Answer
- CVSS
- 9.8
- EPSS (exploit probability)
- N/A
- Status
- patched
- Published
Is CVE-2026-90910 being exploited?
Not on any exploited-vulnerability catalog we track. CVE-2026-90910 was not on the CISA, ENISA or CIRCL exploited catalogs as of our 2026-10-20 snapshot. That can change quickly; check the write-up below for the latest reporting.
- CISA KEV[ — ]
- ENISA EUVD (exploited)[ — ]
- CIRCL KEV[ — ]
Catalog snapshot 2026-10-20. Full cross-catalog view: /kev-comparison
Apache Answer through 2.0.2 contains a missing authentication vulnerability on the reaction API endpoint. The endpoint failed to enforce content visibility controls, so unauthenticated network requests could read content the platform was configured to restrict.
The Apache Software Foundation disclosed the flaw and released a fix. See the Apache security announcement for the patched version and full details.
Other Apache Software Foundation CVEs we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV |
|---|---|---|---|---|
| CVE-2026-82384 Apache Roller XML-RPC Deserialization Allows Unauthenticated RCEwrite-up | [ CRITICAL ] | 9.8 | 0.8% | — |
| CVE-2026-82383 Apache Roller Missing Auth Lets Attackers Change Site Configurationwrite-up | [ HIGH ] | 8.2 | 0.5% | — |
| CVE-2026-82379 Apache Roller WSSE Auth Bypass via Digest Replaywrite-up | [ HIGH ] | 7.7 | 0.4% | — |
| CVE-2026-82378 Apache Roller OAuth 1.0a Authorization Bypass Allows Token Theftwrite-up | [ CRITICAL ] | 9.0 | 0.4% | — |
