Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitymedium

CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content

1 source · 3 articlesFirst reported Updated ()1
Merged summary · from the lead articleSummaries by Vani AI

Apache Answer through 2.0.2 let authenticated users modify non-public content they should not access.

Apache disclosed CVE-2026-79633, a moderate missing-authorization flaw in Apache Answer through 2.0.2. Authenticated users could perform actions on non-public content they were not permitted to access. The issue is fixed in version 2.0.3 and was reported by Luigi Colluto. No in-the-wild exploitation is mentioned.

Key facts
  • CVE-2026-79633 affects Apache Answer through 2.0.2.
  • Authenticated users could mutate non-public content they were not allowed to access.
  • Missing authorization checks are fixed in version 2.0.3.
  • Reported by Luigi Colluto; severity rated moderate.
Analyze CVE-2026-79633 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-79633CVE-2026-76994CVE-2026-79620CVE-2026-64944CVE-2026-79613CVE-2026-68482CVE-2026-64945
Vendors
ApacheApache Software Foundation
Products
Apache Answer
Organizations
Apache Software Foundation

Coverage

oldest first · one row per article · UTC
  1. · 14d ago oss-securityFirst report

    CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content

    Apache Answer through 2.0.2 stores imported question HTML unsanitized, enabling stored cross-site scripting.

  2. · 14d ago oss-security

    CVE-2026-64945: Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions

    Apache Answer through 2.0.2 lets unpin-only users hide or show questions.

  3. · 14d ago oss-security

    CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup

    Apache Answer through 2.0.2 leaks invited-user lists for non-public questions.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-64944
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Answer
——
CVE-2026-64945
A vulnerability in Apache Answer
——
CVE-2026-68482
Missing Authorization vulnerability in Apache Answer
5.3—
CVE-2026-76994
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer
——
CVE-2026-79613
+1 related CVE
CVE-2026-79633
vulnerability in Apache Answer
——
CVE-2026-79620
Exposure of sensitive information through data queries vulnerability in Apache Answer
——