CVE-2026-48911

Apache Answer through 2.0.2 has a missing authentication for critical function vulnerability. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted content or add and remove their own reactions.

Apache Answer through version 2.0.1 has insufficient session expiration: administrative API keys remain usable after the owning administrator is demoted or the account is marked inactive, suspended, or deleted, allowing continued access until the keys are explicitly removed.

Apache Answer through 2.0.2 has an incorrect implementation of authentication algorithm vulnerability. A flaw in the User Center login integration can cause a newly created external user session to omit its external identity, allowing subsequent requests to bypass central account suspension or deletion checks until the session expires or is revoked.

Apache Answer through 2.0.2 has a missing authorization checks vulnerability. Authenticated users could perform actions on non-public content they were not permitted to access.

Apache Answer through 2.0.2 has an insufficient session expiration vulnerability. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.

Apache Answer through 2.0.2 has an exposure of sensitive information through data queries vulnerability. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.

In Apache Answer through 2.0.2, unauthenticated attackers could access comments associated with non-public content through public user profiles. The flaw stems from insufficient visibility checks on comments.

In Apache Answer through 2.0.2, unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. This is an exposure of sensitive information to unauthorized actors.

In Apache Answer through 2.0.2, an authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.

In Apache Answer through 2.0.2, an unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.