CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata

Q: Who can exploit this issue?

An attacker must be authenticated to Apache Answer. The affected authorization check is in similar-question search, so exposure occurs through that feature.

Q: What information could be disclosed?

Authenticated users may be able to view metadata associated with non-public questions. The provided information does not specify which metadata fields are exposed.

Q: Which versions are affected and what is the fix?

Apache Answer through version 2.0.2 is affected. Upgrade to version 2.0.3, which fixes the authorization issue.

Published Oct 16, 2026

Updated

Exposure of sensitive information through data queries vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Affected Software

1 affected component

Apache Answer<=2.0.2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Apache Answer to a version that resolves this vulnerability.
Fixed in 2.0.3

Event History

Oct 19, 2026

CVE Published

via MITRE·09:34 AM

Data Sourced

via MITRE·09:34 AM

DescriptionWeakness

Data Sourced

via NVD·10:16 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to Apache Answer. The affected authorization check is in similar-question search, so exposure occurs through that feature.

What information could be disclosed?

Authenticated users may be able to view metadata associated with non-public questions. The provided information does not specify which metadata fields are exposed.

Which versions are affected and what is the fix?

Apache Answer through version 2.0.2 is affected. Upgrade to version 2.0.3, which fixes the authorization issue.

CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What information could be disclosed?

Which versions are affected and what is the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What information could be disclosed?

Which versions are affected and what is the fix?