Apache Answer <=2.0.2 Missing Auth Allows API Key Access to Hidden Answers
CVE-2026-71563 Published on October 19, 2026
Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions
Missing Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Vulnerability Analysis
CVE-2026-71563 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality, a small impact on integrity and availability.
Weakness Type
What is an AuthZ Vulnerability?
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVE-2026-71563 has been classified to as an AuthZ vulnerability or weakness.
Products Associated with CVE-2026-71563
Want to know whenever a new CVE is published for Apache Answer? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Answer:- Before and including 2.0.2 is affected.