Threat Intelligence Database

Apache Answer versions prior to 2.0.2 contain an insufficient session expiration vulnerability where administrative API keys remain valid even after the associated administrator account is demoted, suspended, marked inactive, or deleted. This allows continued unauthorized access until the keys are explicitly revoked. The issue is fixed in version 2.0.2.

CVE-2026-60053 is a critical vulnerability in Apache Answer versions prior to 2.0.2. It involves insufficient session expiration where administrative API keys remain valid even after the associated administrator account is demoted, suspended, marked inactive, or deleted. This flaw allows continued unauthorized access until the keys are explicitly removed. The issue is resolved in Apache Answer version 2.0.2.

CVE-2026-60023 is a high-severity vulnerability in Apache Answer that allows unauthorized users to access deleted or pending answers through the single-answer read path if the parent question remains visible. This exposure of sensitive information could lead to unauthorized disclosure of answer content that should have been inaccessible. The issue affects Apache Answer versions prior to 2.0.2. Upgrading to version 2.0.2 resolves the vulnerability.

CVE-2026-50749 is an improper authorization vulnerability in Apache Answer affecting versions prior to 2.0.2. Authenticated users without review permissions can reject arbitrary pending edit-revisions due to a missing authorization check. The issue is fixed in version 2.0.2.

CVE-2026-48912 is an improper input validation vulnerability in Apache Answer up to version 2.0.1. The flaw allows any authenticated user to delete other users' uploaded files by exploiting a missing ownership check in the avatar-cleanup logic. The issue is fixed in version 2.0.2.

CVE-2026-48911 is a high-severity vulnerability in Apache Answer up to version 2.0.1. It involves a missing authorization check in the external-login email binding flow, allowing unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link. The issue is fixed in version 2.0.2.

CVE-2026-48834 is a high-severity vulnerability in Apache Answer up to version 2.0.1. It involves improper handling of length parameter inconsistencies, allowing unauthenticated attackers to cause a denial of service by sending a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing. The issue is fixed in version 2.0.2.

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The unlisted question feature did not enforce access restrictions on direct API endpoints, allowing authenticated users to discover and access unlisted questions, their answers, comments, and revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the server process to crash. Users are recommended to upgrade to version 2.0.1, which fixes the issue.