CVE-2026-90910

{
  "etk_id": "ETK-2026-2099",
  "cve_id": "CVE-2026-90910",
  "display_id": "CVE-2026-90910",
  "ghsa_id": "GHSA-q532-rv5p-f5vr",
  "euvd_id": "EUVD-2026-104165",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Missing authentication in Apache Answer reaction API",
  "summary": "Apache Answer through 2.0.2 does not properly enforce access controls for reaction API operations on restricted content. An unauthorized user may view associated reaction metadata or add and remove their own reactions when restricted content is present.",
  "mitigation": "Upgrade Apache Answer to version 2.0.3 or later. Restrict access to the reaction API until the update is deployed.",
  "vendor": "Apache Software Foundation",
  "product": "Apache Answer",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 2.0.2"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Apache Answer",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": 0.0064,
  "epss_percentile": 0.4963,
  "epss_asof": "2026-10-20",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 12.662122483333333,
  "t0_at": "2026-10-19T09:35:54.679000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-19T09:35:54.679000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-19T09:35:54.679000+00:00",
      "url": "https://github.com/advisories/GHSA-q532-rv5p-f5vr"
    }
  }
}