CVE-2026-67249CWE-863broken-access-control

CVE-2026-67249

published October 19, 2026

CVSS
—
EPSS
0%
Percentile
6.8
In the wild
Unconfirmed
What it is

A vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.8th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-10-19T14:16Z
References (2)
https://lists.apache.org/thread/kbdgj9vzd24zb4r2d9ydqyr6f70rpg0v · [email protected]http://www.openwall.com/lists/oss-security/2026/10/16/25 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 OCT 03:31Z
    EPSS moved — → 0%
    epss
  • 19 OCT 09:31Z
    Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
    cvelistv5
  • 19 OCT 09:31Z
    Apache Answer: Email Code Purpose Confusion May Allow Account Takeover
    cvelistv5