Cyber ·
CVE-2026-68482: Apache Answer lets users view invited members of non-public questions
Low-severity advisory on missing visibility checks in Apache Answer, which can expose the list of invited users for non-public questions. The fix is in version 2.0.3.
Advisory CVE-2026-68482, posted to the oss-sec feed on 15 October 2026, describes a missing authorization vulnerability in Apache Answer. Up to version 2.0.2, the application does not check the visibility of non-public questions before returning the list of invited users associated with them. As a result, an unauthenticated or unauthorized user can retrieve that list. The author rated the severity as low. The recommended action is to upgrade to version 2.0.3, which fixes the issue. Credit for the finding is given to a researcher named in the source. For organizations running Apache Answer, the practical step is to inventory deployed versions, upgrade any instance at 2.0.2 or earlier, and review which private questions could have been exposed before the fix. Rota Nacional does not patch third-party software and does not replace this upgrade. This content is informational; verify it against the original source.