CVE-2026-68482: Apache Answer: Improper Authorization in Question Invite User Lookup

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-19 · updated 2026-10-30
Weakness: CWE-862

Description

Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Affected products

Apache Software Foundation Apache Answer: through 2.0.2

References

https://lists.apache.org/thread/m2tbvdv12hmr9sw6ft53rjnww8hqzds0
http://www.openwall.com/lists/oss-security/2026/10/16/26

Get alerted when CVE-2026-68482 or the next vulnerability affects your stack