https://seclists.org/oss-sec/2026/q4/207: CVE-2026-79633: Apache Answer: Missing Authorization Allows Mutations of Non-Public Content

Q: Who can exploit this issue?

An attacker must be authenticated to Apache Answer. The issue allows authenticated users to perform actions on non-public content that they are not permitted to access.

Q: Which deployments are affected?

Apache Answer versions through 2.0.2 are affected. Version 2.0.3 fixes the issue.

Q: What should teams do to remediate the vulnerability?

Upgrade Apache Answer to version 2.0.3.

Published Oct 16, 2026

Updated

Affected Software

1 affected component

Apache Answer<=2.0.2

Frequently Asked Questions

Who can exploit this issue?

An attacker must be authenticated to Apache Answer. The issue allows authenticated users to perform actions on non-public content that they are not permitted to access.

Which deployments are affected?

Apache Answer versions through 2.0.2 are affected. Version 2.0.3 fixes the issue.

What should teams do to remediate the vulnerability?

Upgrade Apache Answer to version 2.0.3.