Threats affecting pkg:maven/org.apache.answer/answer

Apache Answer versions through 2.0.2 contain a missing authentication vulnerability in the reaction API. This flaw allows unauthorized users to read reaction metadata from restricted content and to add or remove their own reactions. The issue is fixed in version 2.0.3.

Apache Answer versions through 2.0.2 have a vulnerability where full API keys are logged on every authenticated request. This allows anyone with access to the logs to retrieve and reuse active bearer credentials. The issue is fixed in version 2.0.3.

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

CVE-2026-71563 is a missing authorization vulnerability in Apache Answer versions up to 2.0.2. It allows users with a global API key to access answer content linked to hidden, deleted, or pending-review questions. This issue is fixed in version 2.0.3.

CVE-2026-60023 is a high-severity vulnerability in Apache Answer that allows unauthorized users to access deleted or pending answers through the single-answer read path if the parent question remains visible. This exposure of sensitive information could lead to unauthorized disclosure of answer content that should have been inaccessible. The issue affects Apache Answer versions prior to 2.0.2. Upgrading to version 2.0.2 resolves the vulnerability.

CVE-2026-60053 is a critical vulnerability in Apache Answer versions prior to 2.0.2. It involves insufficient session expiration where administrative API keys remain valid even after the associated administrator account is demoted, suspended, marked inactive, or deleted. This flaw allows continued unauthorized access until the keys are explicitly removed. The issue is resolved in Apache Answer version 2.0.2.

CVE-2026-50749 is an improper authorization vulnerability in Apache Answer affecting versions prior to 2.0.2. Authenticated users without review permissions can reject arbitrary pending edit-revisions due to a missing authorization check. The issue is fixed in version 2.0.2.

CVE-2026-48912 is an improper input validation vulnerability in Apache Answer up to version 2.0.1. The flaw allows any authenticated user to delete other users' uploaded files by exploiting a missing ownership check in the avatar-cleanup logic. The issue is fixed in version 2.0.2.

CVE-2026-48911 is a high-severity vulnerability in Apache Answer up to version 2.0.1. It involves a missing authorization check in the external-login email binding flow, allowing unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link. The issue is fixed in version 2.0.2.

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The unlisted question feature did not enforce access restrictions on direct API endpoints, allowing authenticated users to discover and access unlisted questions, their answers, comments, and revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. A crafted TIFF image could trigger excessive memory allocation during image decoding, allowing an authenticated user to cause the server process to crash. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Apache Answer versions up to and including 2.0.0 contain a vulnerability where timeline-related APIs do not enforce proper authorization checks. This flaw allows authenticated users to access deleted, private, or unapproved content and its revision history. The issue is fixed in version 2.0.1. The vulnerability has a medium severity with a CVSS score of 6.1.