CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup
Apache Answer through 2.0.2 leaks invited-user lists for non-public questions.
Apache disclosed CVE-2026-68482, an improper-authorization bug in Apache Answer through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list for a non-public question because visibility checks are missing. The vendor rates it low and says version 2.0.3 fixes it. Credit is given to Yash Shendge; exploitation is not reported.
- Affects Apache Answer through 2.0.2; fixed in 2.0.3.
- Unauthenticated or unauthorized users can list invitees of non-public questions.
- Missing visibility checks; vendor severity is low.
- Credited to Yash Shendge; no exploitation reported.
- CVEs
- CVE-2026-68482
- Vendors
- Apache Software Foundation
- Products
- Apache Answer
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-68482 | Missing Authorization vulnerability in Apache Answer | 5.3 | — |
From the original article
Posted by Enxin Xie on Oct 15 Severity: low Affected versions: - Apache Answer through 2. 0. 2 Description: Missing Authorization vulnerability in Apache Answer.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.