CVE-2026-67249: Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
A vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
Which deployments are affected?
Apache Answer versions through 2.0.2 are affected. Version 2.0.3 fixes the issue.
What does an attacker need to exploit this issue?
The issue involves a verification code issued in one email-based workflow being accepted by another sensitive workflow. The provided information does not specify additional attacker prerequisites.
What should teams do if they are running an affected version?
Upgrade Apache Answer to version 2.0.3, which fixes the code-purpose enforcement issue.