Apache Answer <2.0.3 Unauth Access to Non-Public Content
CVE-2026-79633 Published on October 19, 2026
Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Weakness Type
Exposure of Sensitive Information Through Data Queries
When trying to keep information confidential, an attacker can often infer some of the information by using statistics. In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.
Products Associated with CVE-2026-79633
Want to know whenever a new CVE is published for Apache Answer? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Answer:- Before and including 2.0.2 is affected.