Threats affecting pkg:maven/org.apache/answer

Apache Answer versions through 2.0.2 have a missing authorization vulnerability in the MCP answer retrieval tool. This flaw allows users with a global API key to access answer content for hidden, deleted, or pending-review questions. The issue is fixed in version 2.0.3.

CVE-2026-86589 is a vulnerability in Apache Answer up to version 2.0.2 involving incorrect implementation of the authentication algorithm. The flaw allows a newly created external user session to omit its external identity, which can enable bypassing of central account suspension or deletion checks until the session expires or is revoked. This issue is fixed in version 2.0.3.

CVE-2026-68482 is a missing authorization vulnerability in Apache Answer up to version 2.0.2. It allows unauthenticated or unauthorized users to retrieve the invited-user list of a non-public question due to missing visibility authorization checks. The issue is fixed in version 2.0.3.

CVE-2026-48834 is a high-severity vulnerability in Apache Answer up to version 2.0.1. It involves improper handling of length parameter inconsistencies, allowing unauthenticated attackers to cause a denial of service by sending a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. The issue is fixed in version 2.0.2.