What’s Vulnerable › Products

Apache Software Foundation Apache Answer vulnerabilities

37 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.

Check whether your Apache Software Foundation Apache Answer version is affected

Latest Apache Software Foundation Apache Answer vulnerabilities

• CVE-2026-90910 — Apache Answer: Reaction API authorization bypass for restricted content (CVSS 9.8)
• CVE-2026-86589 — Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
• CVE-2026-79633 — Apache Answer: Missing Authorization Allows Mutations of Non-Public Content
• CVE-2026-79624 — Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
• CVE-2026-79620 — Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
• CVE-2026-79613 — Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
• CVE-2026-76994 — Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
• CVE-2026-71563 — Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions (CVSS 4.3)
• CVE-2026-68482 — Apache Answer: Improper Authorization in Question Invite User Lookup
• CVE-2026-67249 — Apache Answer: Email Code Purpose Confusion May Allow Account Takeover (CVSS 5.4)
• CVE-2026-64945 — Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions
• CVE-2026-64944 — Apache Answer: Stored XSS via unsanitized HTML in imported question content
• CVE-2026-64943 — Apache Answer: API keys logged in plaintext during authentication (CVSS 8.1)
• CVE-2026-60053 — Apache Answer: Residual Administrative API Key Access After Role or Account Revocation (CVSS 9.1)
• CVE-2026-60023 — Apache Answer: Unauthorized disclosure of deleted or pending answer content (CVSS 7.5)
• CVE-2026-50749 — Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions (CVSS 6.5)
• CVE-2026-48912 — Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL (CVSS 6.5)
• CVE-2026-48911 — Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow (CVSS 7.5)
• CVE-2026-48834 — Apache Answer: Denial of service via crafted Accept-Language header parsing (CVSS 7.5)
• CVE-2026-25700 — Apache Answer: AdminToken not invalidated after admin deactivation (CVSS 7.2)
• CVE-2026-34905 — Apache Answer: Unlisted Questions Accessible via Direct API Access (CVSS 6.5)
• CVE-2026-34033 — Apache Answer: HTML Content Injection in Email (CVSS 5.4)
• CVE-2026-34031 — Apache Answer: The custom avatar was not properly validated (CVSS 6.5)
• CVE-2026-33582 — Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error (CVSS 6.5)
• CVE-2026-25699 — Apache Answer: Authorization Bypass in Timeline API (CVSS 6.1)