Apache Answer <=2.0.2: Auth Bypass Reveals Metadata in Similar-Question Search
CVE-2026-79620 Published on October 19, 2026
Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
Exposure of sensitive information through data queries vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Weakness Type
Exposure of Sensitive Information Through Data Queries
When trying to keep information confidential, an attacker can often infer some of the information by using statistics. In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.
Products Associated with CVE-2026-79620
Want to know whenever a new CVE is published for Apache Answer? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Answer:- Before and including 2.0.2 is affected.