{"id":"CVE-2026-67249","kind":"vulnerability","aliases":["CVE-2026-67249"],"related":[],"title":"Apache Answer: email verification codes accepted across different sensitive workflows","description":"A vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nA verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","summary":"Apache Answer does not check the purpose of an email verification code, so a code issued for one workflow can be accepted by another sensitive workflow. An attacker who obtains a valid code for one email-based action could use it to complete a different sensitive action.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-answer","package","self-hosted"],"not_affected_if":["version-2.0.3-or-later"],"how_to_check":"- Check the installed Apache Answer version and see whether it is `2.0.2` or earlier.\n- unknown","fix":"- Upgrade Apache Answer to `2.0.3` or later.","status":"open","published_at":"2026-10-19T10:16:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:33+00:00","updated_at":"2026-10-25T05:12:33+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T05:12:33Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Answer to `2.0.3` or later.","reach":"internet","title":"Apache Answer: email verification codes accepted across different sensitive workflows","impact":"medium","summary":"Apache Answer does not check the purpose of an email verification code, so a code issued for one workflow can be accepted by another sensitive workflow. An attacker who obtains a valid code for one email-based action could use it to complete a different sensitive action.","category":"package","nicknames":[],"who_cares":["apache-answer","self-hosted"],"confidence":0.5,"needs_auth":"yes","worst_case":"Attacker completes a sensitive account action using another workflow's code.","analyst_note":"Sources do not name the affected workflows or the attack prerequisites; check the Apache Answer 2.0.3 release notes or the NVD entry for details.","how_to_check":"- Check the installed Apache Answer version and see whether it is `2.0.2` or earlier.\n- unknown","needs_analyst":true,"not_affected_if":["version-2.0.3-or-later"],"who_is_affected":"Teams running Apache Answer through version `2.0.2` that use email verification codes for account actions. Sources do not say which workflows are sensitive or how common the affected setup is, so exposure beyond the version check is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000573,"input_tokens":3292,"output_tokens":488,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-67249':13A,16A '2.0.2':83C '2.0.3':116C 'accept':6A,45B,96C 'across':7A 'action':62B,71B 'affect':79C 'anoth':47B,98C 'answer':2A,19B,25B,76C,81C 'apach':1A,18B,24B,75C,80C 'apache-answ':17B 'attack':51B 'base':61B,92C 'check':28B 'code':5A,35B,38B,56B,86C,103C 'complet':67B 'could':63B,94C 'cve':11A,14A 'differ':8A,69B 'email':3A,33B,60B,91C 'email-bas':59B,90C 'enforc':108C 'fix':118C 'host':23B 'issu':39B,78C,87C,120C 'obtain':53B 'one':41B,58B,89C 'packag':20B 'proper':107C 'purpos':30B,104C 'recommend':111C 'self':22B 'self-host':21B 'sensit':9A,48B,70B,99C 'upgrad':113C 'use':64B 'user':109C 'valid':55B 'verif':4A,34B,85C 'version':115C 'vulner':73C 'workflow':10A,42B,49B,93C,100C","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Answer through version `2.0.2` that use email verification codes for account actions. Sources do not say which workflows are sensitive or how common the affected setup is, so exposure beyond the version check is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67249","severity":null,"published_at":"2026-10-19T10:16:48+00:00","modified_at":"2026-10-19T20:47:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}