https://seclists.org/oss-sec/2026/q4/201: CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup

Q: Who is exposed to this issue?

Instances running Apache Answer 2.0.2 or earlier are affected. The exposure concerns invited-user lists for non-public questions.

Q: What access does an attacker need?

No authentication or authorization is required. An unauthenticated or otherwise unauthorized user can retrieve the invited-user list because visibility authorization checks are missing.

Q: What should administrators do?

Upgrade Apache Answer to version 2.0.3, which fixes the issue.

Published Oct 16, 2026

Updated

Affected Software

1 affected component

Apache Answer<=2.0.2

Frequently Asked Questions

Who is exposed to this issue?

Instances running Apache Answer 2.0.2 or earlier are affected. The exposure concerns invited-user lists for non-public questions.

What access does an attacker need?

No authentication or authorization is required. An unauthenticated or otherwise unauthorized user can retrieve the invited-user list because visibility authorization checks are missing.

What should administrators do?

Upgrade Apache Answer to version 2.0.3, which fixes the issue.