CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup
Missing Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Apache Answer installations running version 2.0.2 or earlier are affected, particularly where non-public questions use invited-user lists.
What can an attacker access?
An unauthenticated or unauthorized user can retrieve the list of users invited to a non-public question. The issue is caused by missing visibility authorization checks on the invite-user lookup.
What is the recommended remediation?
Upgrade Apache Answer to version 2.0.3, which fixes the authorization issue.