Cyber ·
CVE-2026-79633: missing authorization in Apache Answer up to version 2.0.2
Moderate-severity advisory: authenticated users of Apache Answer up to version 2.0.2 could act on non-public content without authorization. Version 2.0.3 fixes the issue.
Advisory CVE-2026-79633 describes missing authorization checks in Apache Answer. According to the text, authenticated users could perform actions on non-public content they were not permitted to access. The issue affects version 2.0.2 and earlier, and version 2.0.3 fixes it. The stated severity is moderate. The disclosure was posted by Enxin Xie on the oss-sec list on 15 October, and the record carries a date of 16 October 2026. Luigi Colluto is credited as the reporter. The recommended action is to upgrade to version 2.0.3. To assess exposure, confirm the version running on each Apache Answer instance. Rota Nacional is an AI inference platform with an API compatible with OpenAI and Anthropic. It is not the affected software and does not patch, monitor or audit Apache Answer. To verify the original, consult the advisory on the oss-sec list and the release notes of the Apache Answer project.