CRITICALCVSS v3.1 9.8Vulnerability
CVE-2026-90910
Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Properties
- Severity
- CRITICAL
- Nvd fetched at
- 2026-10-20T21:14:08.448323+00:00
- Epss score
- 0.00637
- Cvss severity
- CRITICAL
- Cvss score
- 9.8
- Retrieved at
- 2026-10-21T01:24:51+00:00
- Last source
- FIRST EPSS
- Score
- 9.8
- Cvss version
- 3.1
- Cve id
- CVE-2026-90910
- Cvss vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- First seen by Signal
- 2026-10-19T11:09:13+00:00
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Published at
- 2026-10-19T10:16:49.897
- Last modified
- 2026-10-19T20:45:51.597
- Epss percentile
- 0.49631
Related Entities (1)
HAS_WEAKNESS (1)
Explore deeper with Ninja Signal's threat intelligence graph