Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content

1 source · 8 articlesFirst reported Updated ()
Merged summary · from the lead articleSummaries by Vani AI

Apache Answer through 2.0.2 let authenticated users modify non-public content they should not access.

Apache disclosed CVE-2026-79633, a moderate missing-authorization flaw in Apache Answer through 2.0.2. Authenticated users could perform actions on non-public content they were not permitted to access. The issue is fixed in version 2.0.3 and was reported by Luigi Colluto. No in-the-wild exploitation is mentioned.

Key facts
  • CVE-2026-79633 affects Apache Answer through 2.0.2.
  • Authenticated users could mutate non-public content they were not allowed to access.
  • Missing authorization checks are fixed in version 2.0.3.
  • Reported by Luigi Colluto; severity rated moderate.
Analyze CVE-2026-79633 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-71563CVE-2026-76994CVE-2026-79613CVE-2026-79620CVE-2026-79624CVE-2026-79633CVE-2026-86589CVE-2026-90910
Vendors
Apache
Products
Apache Answer
Organizations
Apache Software Foundation

Coverage

oldest first · one row per article · UTC
  1. · 14d ago oss-securityFirst report

    CVE-2026-71563: Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions

    Apache Answer through 2.0.2 lets global API keys read answers on non-public questions.

  2. · 14d ago oss-security

    CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles

    Unauthenticated users can pull hidden-question metadata from Apache Answer public profiles.

  3. · 14d ago oss-security

    CVE-2026-79613: Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles

    Moderate Apache Answer flaw can expose comments on non-public content via public profiles.

  4. · 14d ago oss-security

    CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata

    Apache Answer through 2.0.2 lets authenticated users view metadata of non-public questions.

  5. · 14d ago oss-security

    CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation

    Revoked Apache Answer sessions kept access to private uploads via stale visit tokens through 2.0.2.

  6. · 14d ago oss-security

    CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content

    Apache Answer through 2.0.2 let authenticated users modify non-public content they should not access.

  7. · 14d ago oss-security

    CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension

    Apache Answer User Center sessions can ignore central account suspension or deletion until they expire.

  8. · 14d ago oss-security

    CVE-2026-90910: Apache Answer: Reaction API authorization bypass for restricted content

    Apache Answer through 2.0.2 lets unauthorized users read or change reaction metadata on restricted content.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-71563
Missing Authorization vulnerability in Apache Answer
4.3—
CVE-2026-76994
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer
——
CVE-2026-79613
+1 related CVE
CVE-2026-79633
vulnerability in Apache Answer
——
CVE-2026-79620
Exposure of sensitive information through data queries vulnerability in Apache Answer
——
CVE-2026-79624
Insufficient session expiration vulnerability in Apache Answer
——
CVE-2026-86589
Incorrect implementation of authentication algorithm vulnerability in Apache Answer
5.4—
CVE-2026-90910
Missing auth on Apache Answer reaction API through 2.0.2
9.8—