Vulnerabilitymedium
CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
AI summary · grok-4.7Summaries by Vani AI
Revoked Apache Answer sessions kept access to private uploads via stale visit tokens through 2.0.2.
CVE-2026-79624 is a moderate insufficient-session-expiration flaw in Apache Answer through 2.0.2. After session revocation, a stale visit token still allowed access to known private uploaded files. Apache says version 2.0.3 fixes the issue; Maksim Hayder is credited. No active exploitation is reported.
Key facts
- CVE-2026-79624 affects Apache Answer through 2.0.2.
- Revoked users could still open known private uploads with a stale visit token.
- Insufficient session invalidation is fixed in 2.0.3.
- Reported by Maksim Hayder; Apache rates it moderate.
- CVEs
- CVE-2026-79624
- Vendors
- Apache
- Products
- Apache Answer
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-79624 | Insufficient session expiration vulnerability in Apache Answer | — | — |
From the original article
Posted by Enxin Xie on Oct 15 Severity: moderate Affected versions: - Apache Answer through 2. 0. 2 Description: Insufficient session expiration vulnerability in Apache Answer.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.