SB2026102307 - Multiple vulnerabilities in Apache Answer

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026102307

SB2026102307 - Multiple vulnerabilities in Apache Answer

Published: October 23, 2026

Security Bulletin ID SB2026102307
CSH Severity
High
Patch available
YES
Number of vulnerabilities 13
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 8% Medium 38% Low 54%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 13 vulnerabilities.


1) Inclusion of Sensitive Information in Log Files (CVE-ID: CVE-2026-64943)

CWE-ID: CWE-532 - Information Exposure Through Log Files

CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a local user to recover active API keys from application logs and replay them to gain unauthorized API access.

The vulnerability exists due to insertion of sensitive information into log files in Apache Answer's authentication logging when processing authenticated requests. A local user can read full API keys recorded in application logs and replay these bearer credentials to access the API with the permissions associated with the exposed keys.


2) Cross-site scripting (CVE-ID: CVE-2026-64944)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary JavaScript in the browsers of users viewing imported questions, including privileged users.

The vulnerability exists due to improper neutralization of HTML in the Apache Answer importer when importing question bodies without applying the normal Markdown-to-HTML sanitization process. A remote attacker can supply an imported data source containing malicious HTML to persist executable content that runs when users view the imported questions.


3) Incorrect authorization (CVE-ID: CVE-2026-64945)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to hide or restore questions without the required permissions.

The vulnerability exists due to incorrect authorization in the Apache Answer question operation controller when handling requests to hide or show questions. A remote user can use the question.unpin permission, which is incorrectly checked for these operations, to hide or restore questions without holding question.hide or question.show.


4) Improper Authentication (CVE-ID: CVE-2026-67249)

CWE-ID: CWE-287 - Improper Authentication

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to potentially take over an account.

The vulnerability exists due to improper enforcement of verification-code purpose in Apache Answer's email-based workflows when validating codes for sensitive operations. A remote attacker can submit a verification code issued for one workflow to another sensitive workflow to potentially take over an account.


5) Missing Authorization (CVE-ID: CVE-2026-68482)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to retrieve the invited-user list associated with a non-public question without authorization.

The vulnerability exists due to missing visibility authorization checks in the question invite user lookup feature of Apache Answer when handling requests for invited-user lists. A remote attacker can request the invited-user list for a non-public question to disclose information about its invited users.


6) Missing Authorization (CVE-ID: CVE-2026-71563)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access answer content associated with hidden, deleted, or pending-review questions.

The vulnerability exists due to missing authorization in the MCP answer retrieval tool when retrieving answers associated with non-public questions. A remote user can use a global API key to retrieve these answers to disclose content that should not be publicly accessible.


7) Information disclosure (CVE-ID: CVE-2026-76994)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to obtain metadata associated with hidden questions.

The vulnerability exists due to insufficient restriction of sensitive information in Apache Answer's public answer profiles when displaying metadata associated with hidden questions. A remote attacker can access these public profiles to obtain hidden-question metadata without authorization.


8) Incorrect authorization (CVE-ID: CVE-2026-79613)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to access comments associated with non-public content.

The vulnerability exists due to improper access control in Apache Answer's public user profile functionality when displaying comments associated with non-public content. A remote attacker can view public user profiles to access comments that should not be publicly accessible.


9) Incorrect authorization (CVE-ID: CVE-2026-79620)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access metadata of non-public questions without authorization.

The vulnerability exists due to improper authorization in the similar-question search feature of Apache Answer when processing search queries. A remote user can submit search queries to retrieve metadata of non-public questions that they are not authorized to view.


10) Insufficient Session Expiration (CVE-ID: CVE-2026-79624)

CWE-ID: CWE-613 - Insufficient Session Expiration

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to access known private uploaded files after session revocation.

The vulnerability exists due to insufficient session expiration in Apache Answer's visit-token validation mechanism when user sessions are revoked. A remote user can reuse a stale visit token to retain access to known private uploaded files.


11) Missing Authorization (CVE-ID: CVE-2026-79633)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify non-public content without authorization.

The vulnerability exists due to missing authorization checks in Apache Answer when handling actions on non-public content. A remote user can submit actions targeting content they are not permitted to access to make unauthorized changes.


12) Incorrect Implementation of Authentication Algorithm (CVE-ID: CVE-2026-86589)

CWE-ID: CWE-303 - Incorrect Implementation of Authentication Algorithm

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to bypass central account suspension or deletion checks and retain access through an existing session.

The vulnerability exists due to incorrect implementation of an authentication algorithm in the User Center login integration when creating an external user's first-login session without its external identity. A remote user can continue making requests with the affected session after central account suspension or deletion to retain access until the session expires or is revoked.


13) Missing Authentication for Critical Function (CVE-ID: CVE-2026-90910)

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to read reaction metadata associated with restricted content and add or remove their own reactions without authorization.

The vulnerability exists due to missing authentication for critical functionality in the Apache Answer reaction API when handling requests involving restricted content. A remote attacker can submit requests that bypass content visibility controls to retrieve reaction metadata or add and remove their own reactions on content they are not authorized to access.


Remediation

Install update from vendor's website.

References