Apache Answer 2.0.2 Missing Auth for Invited-User List
CVE-2026-68482 Published on October 19, 2026
Apache Answer: Improper Authorization in Question Invite User Lookup
Missing Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-68482 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-68482
Want to know whenever a new CVE is published for Apache Answer? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Answer:- Before and including 2.0.2 is affected.