CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
Apache Answer through 2.0.2 lets global API keys read answers on non-public questions.
Apache disclosed CVE-2026-71563, a missing-authorization flaw in Apache Answer through 2.0.2. The MCP answer retrieval tool lets holders of a global API key read answer content tied to hidden, deleted, or pending-review questions. Apache rates the issue moderate and recommends upgrading to 2.0.3. No in-the-wild exploitation is mentioned.
- Affects Apache Answer through 2.0.2; fixed in 2.0.3.
- Global API key holders can read answers on hidden, deleted, or pending questions.
- Vendor rates the missing-authorization flaw moderate.
- No exploitation in the wild is reported.
- CVEs
- CVE-2026-71563
- Vendors
- Apache Software Foundation
- Products
- Apache Answer
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-71563 | Missing Authorization vulnerability in Apache Answer | 4.3 | — |
From the original article
Posted by Enxin Xie on Oct 15 Severity: moderate Affected versions: - Apache Answer through 2. 0. 2 Description: Missing Authorization vulnerability in Apache Answer.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.