{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aapacheanswer/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-90910"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Answer (\u003c= 2.0.2)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","web-application","apache"],"_cs_type":"advisory","_cs_vendors":["Apache"],"content_html":"\u003cp\u003eApache Answer versions 2.0.2 and earlier contain a critical authentication bypass vulnerability, identified as CVE-2026-90910. The vulnerability resides within the application's reaction API, which fails to properly enforce content visibility controls. This oversight allows unauthenticated or unauthorized users to interact with the API to read reaction metadata associated with restricted or private content, as well as add or remove reactions on content they should not have access to. The vulnerability carries a CVSS 3.1 base score of 9.8, indicating the potential for significant unauthorized data access within the platform. Organizations currently running affected versions of Apache Answer are strongly advised to upgrade to version 2.0.3 to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of this vulnerability allows unauthorized users to bypass existing access control mechanisms to read sensitive metadata and modify interactions on restricted content. This could result in information disclosure and the manipulation of user activity data, impacting the integrity and confidentiality of discussions within the Apache Answer instance.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade all Apache Answer installations to version 2.0.3 or later to patch CVE-2026-90910.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for high volumes of unexpected or anomalous requests targeting the reaction API endpoints if patching cannot be performed immediately.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-19T20:12:02Z","date_published":"2026-10-19T20:12:02Z","id":"https://feed.craftedsignal.io/briefs/2026-10-apache-answer-auth-bypass/","summary":"Apache Answer versions 2.0.2 and earlier contain an authentication bypass vulnerability in the reaction API that allows unauthorized users to access restricted metadata and manipulate content reactions.","title":"Authentication Bypass Vulnerability in Apache Answer","url":"https://feed.craftedsignal.io/briefs/2026-10-apache-answer-auth-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}