https://seclists.org/oss-sec/2026/q4/206: CVE-2026-79624: Apache Answer: Stale Visit Tokens tain Access to Private Uploads After Session vocation
Published Oct 16, 2026
·Updated
Affected Software
1 affected component
Apache Answer<=2.0.2
The attacker needs a stale visit token from a user whose access has been revoked, along with knowledge of the private uploaded file they want to access.
Known private uploaded files may remain accessible using the stale visit token. The provided information does not indicate access to files whose locations are not known.
Apache Answer versions through 2.0.2 are affected. The issue is described as insufficient session invalidation, so deployments using revoked-user workflows should treat stale tokens as potentially valid until remediated.
Upgrade Apache Answer to version 2.0.3, which fixes the issue.