Apache Answer CVE-2026-90910

Exploitation requires the target to be running Apache Answer at or below version 2.0.2 and requires content that is visibility-restricted (private/limited-audience posts) for which reaction data exists - the flaw only matters where the reaction API is used against such restricted content. The reaction API endpoint must be network-reachable to the attacker. Limiting factors: impact is confined to reaction metadata disclosure and the attacker's own reaction add/remove actions - the restricted content body itself is not exposed, and no server-side integrity or availability impact occurs; severity is capped at 'moderate' by the vendor. No non-default configuration appears necessary, as this is the default behavior of affected versions.

This is a low-to-moderate real-world risk, not a top-priority emergency. Apache rated it 'moderate' and provided no CVSS vector, EPSS score, or SSVC decision data, so quantitative exploitation signals are entirely absent from the input. The underlying weakness (CWE-287/862 style 'Missing authentication for critical function' on the reaction API) is a genuine authorization-bypass, but the technical impact is narrow: an actor can read reaction metadata on restricted content and add/remove their own reactions - there is no code execution, data destruction, privilege escalation, or access to the restricted content body itself. Exploitation status is 'no public exploit identified at time of analysis' (no KEV listing and no POC referenced), and no EPSS probability was supplied to contrast against. Because no CVSS vector was provided, attack-vector and complexity cannot be confirmed from NVD; the API nature of the flaw strongly implies network reachability, but this should be verified against the vendor patch (fix in 2.0.3). The description says 'unauthorized users,' implying little to no authentication is required, but per analysis rules this cannot be formally confirmed as PR:N without a CVSS vector - treat the auth requirement as inferred, not confirmed.

An attacker interacts directly with Apache Answer's reaction API endpoint for content that is supposed to be visibility-restricted. Because the API fails to enforce content visibility controls, the attacker enumerates reaction metadata (who/what reacted) on that restricted content and can toggle their own reactions on it, leaking information about otherwise hidden posts. No public exploit code is referenced, and the impact is limited to metadata disclosure and reaction manipulation rather than full content access.