CVE-2026-68482CWE-862broken-access-control

CVE-2026-68482

published October 19, 2026

CVSS
—
EPSS
0%
Percentile
6.8
In the wild
Unconfirmed
What it is

Missing Authorization vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-10-19T14:16Z
References (2)
https://lists.apache.org/thread/m2tbvdv12hmr9sw6ft53rjnww8hqzds0 · [email protected]http://www.openwall.com/lists/oss-security/2026/10/16/26 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 21 OCT 03:31Z
    EPSS moved — → 0%
    epss
  • 19 OCT 09:31Z
    Apache Answer: Improper Authorization in Question Invite User Lookup
    cvelistv5
  • 19 OCT 09:31Z
    Apache Answer: Improper Authorization in Question Invite User Lookup
    cvelistv5