Apache Answer Reaction API Missing Authentication Flaw

Apache Answer is affected by a missing authentication for critical function vulnerability.

The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.

• Affected versions: Apache Answer through 2.0.2
• Fixed in: 2.0.3

Users are recommended to upgrade to version 2.0.3, which fixes the issue.