The vulnerability lies in the reaction API of Apache Answer, where authentication is not enforced for a critical function. This allows an attacker to read reaction metadata from content that should be protected, as well as add or remove their own reactions. The issue represents an authorization bypass (CWE‑306) that can compromise the confidentiality and integrity of user interactions on restricted content.

All installations of Apache Answer with a version up to and including 2.0.2 are affected. The product is the Apache Answer platform, and the vendor is Apache Software Foundation. The advisory recommends upgrading to version 2.0.3 to mitigate the vulnerability.

The CVSS score of 9.8 indicates a critical severity. With no EPSS score available or KEV listing, the exploit probability is unknown, but the impact is high because the flaw allows unauthorized manipulation of content interactions. The likely attack vector is network-based, requiring access to the API endpoint; the description does not specify local privileges, so it is inferred to be remotely exploitable by clients that can reach the server.