CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
Apache Answer through 2.0.2 lets authenticated users view metadata of non-public questions.
Apache disclosed CVE-2026-79620, a moderate improper-authorization flaw in Apache Answer through 2.0.2. An authorization check in similar-question search let authenticated users view metadata of non-public questions. Users should upgrade to 2.0.3. The report, credited to n0mi1k, does not describe in-the-wild exploitation.
- Affects Apache Answer through 2.0.2; fixed in 2.0.3.
- Authenticated users could read metadata of non-public questions via similar-question search.
- Vendor rates the issue moderate; no exploitation is reported.
- CVEs
- CVE-2026-79620
- Vendors
- Apache
- Products
- Apache Answer
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-79620 | Exposure of sensitive information through data queries vulnerability in Apache Answer | — | — |
From the original article
Posted by Enxin Xie on Oct 15 Severity: moderate Affected versions: - Apache Answer through 2. 0. 2 Description: Exposure of sensitive information through data queries vulnerability in Apache Answer.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.