CVE-2026-68482 Apache Answer: Improper Authorization in Question Invite User Lookup

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade ...

CVE-2026-68482

Apache Answer versions through 2.0.2 are vulnerable to a missing authorization (CWE-862) flaw in the question invite user lookup. Due to missing visibility authorization checks, an unauthenticated or unauthorized user can retrieve the invited-user list for questions that are not public. To mitiga...

EUVD-2026-104156

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which...

CVE-2026-67249 Apache Answer: Email Code Purpose Confusion May Allow Account Takeover

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which...

CVE-2026-67249

A vulnerability in Apache Answer affects versions through 2.0.2 . Due to a lack of proper enforcement on code purpose, a verification code issued for one email-based workflow can be improperly accepted by another sensitive workflow, potentially leading to account takeover . To mitigate this risk,...

EUVD-2026-104155

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result the unpin permission instead of the hide permission, so in custom role configurations that separate these permission...

CVE-2026-64945 Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result the unpin permission instead of the hide permission, so in custom role configurations that separate these permission...

CVE-2026-64945

A vulnerability in Apache Answer (through version 2.0.2 ) allows users to hide or restore questions due to an incorrect permission mapping . The question operation controller mistakenly checks for the question.unpin permission instead of the required question.hide or question.show permissions. Th...

CVE-2026-64944 Apache Answer: Stored XSS via unsanitized HTML in imported question content

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, ...

EUVD-2026-104152

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, ...

CVE-2026-64944

Versions of Apache Answer through 2.0.2 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is that the importer stores question bodies from imported data sources as raw HTML, bypassing the standard Markdown-to-HTML sanitization path. Consequently, attacker-controlled HTML ...

EUVD-2026-104151

Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials. Use...

CVE-2026-64943 Apache Answer: API keys logged in plaintext during authentication

Insertion of Sensitive Information into Log File vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Full API keys are written to application logs on every authenticated request, allowing anyone with log-read access to recover and replay active bearer credentials. Use...

CVE-2026-64943

Apache Answer versions through 2.0.2 are vulnerable to an Insertion of Sensitive Information into Log File (CWE-532) flaw. The application writes full API keys to application logs during every authenticated request. An attacker with log-read access can recover these logs to obtain and replay acti...

CVE-2026-67249: Incorrect Authorization

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which...

CVE-2026-64944: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, ...

CVE-2026-79620: Exposure of Sensitive Information Through Data Queries

Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions. Users are recommended to...

CVE-2026-68482: Missing Authorization

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade ...

CVE-2026-64945: Incorrect Authorization

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The question operation controller gates hide/show operations on the wrong permission check result the unpin permission instead of the hide permission, so in custom role configurations that separate these permission...

CVE-2026-86589: Incorrect Implementation of Authentication Algorithm

Incorrect implementation of authentication algorithm vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass...