Key points
- Apache Answer versions up to 2.0.2 are affected by an improper authorization flaw.
- Unauthenticated users can view invited-user lists for non-public questions.
- Version 2.0.3 fixes the issue and is recommended for all users.
Apache Answer versions through 2.0.2 contain a missing authorization vulnerability that allows unauthorized access to specific user data. The flaw enables unauthenticated or unauthorized individuals to retrieve the list of invited users associated with non-public questions. This occurs because the application fails to enforce proper visibility authorization checks. According to an advisory posted by Enxin Xie on October 15, the issue is rated as low severity.
In plain English
The vulnerability allows anyone to see who has been invited to collaborate on private questions within Apache Answer. Even if a question is not public, the list of people invited to view or edit it is exposed. This happens because the software does not verify whether the person requesting the list has permission to see it. An attacker does not need to log in to exploit this gap. They can simply query the system to gather information about user associations with private content.
The background
The issue was identified by Yash Shendge, who is credited with discovering the flaw. The advisory was published on the oss-security mailing list on October 15. It specifically targets the Question Invite User Lookup functionality within the Apache Answer platform. The problem exists in all versions of the software up to and including 2.0.2. The advisory notes that the lack of visibility checks is the root cause of the information disclosure.
What changes now
Users are recommended to upgrade to version 2.0.3, which fixes the authorization issue. This update restores proper visibility checks, preventing unauthorized users from retrieving invited-user lists for non-public questions. Organizations running older versions should prioritize this update to close the gap. The fix addresses the specific missing authorization check that allowed the data leak. No other workarounds are mentioned in the advisory.
Who needs to act first
Teams should identify systems exposing non-public questions to the internet first. Check whether your Apache Answer instance allows anonymous access to question details. If so, prioritize updating these exposed environments before internal-only servers. Verify the current version against the affected range. Back up your configuration before applying the update to version 2.0.3. Test the update in a staging environment to ensure no functionality breaks. Monitor logs for unusual query patterns during the transition.
What to do and how to stay safe: Apache Answer
- Verify your Apache Answer version and compare it against the affected range of versions through 2.0.2.
- Restrict network access to your Apache Answer instance to limit exposure from unauthenticated sources.
- Review server logs for requests to question invite endpoints from unknown IP addresses.
- Prepare to deploy version 2.0.3 once you have validated the update in a non-production environment.
Step-by-step guide: 7 Configuration Errors That Expose Systems to Zero-Day Exploits
General security guidance from the Vuln Post newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which versions of Apache Answer are affected by CVE-2026-68482?
All versions of Apache Answer through 2.0.2 are affected by this vulnerability.
Is there a fix available for this authorization flaw?
Yes, upgrading to version 2.0.3 fixes the issue.
What can an attacker do with this vulnerability?
An unauthenticated or unauthorized user can retrieve the invited-user list for non-public questions.
