Live › vulnerability › CVE-2026-68482
Go to dashboardApache Answer through 2.0.2 fails to check visibility permissions before returning the invited-user list for a non-public question. An unauthenticated or unauthorized user can read which accounts were invited to those questions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Deployments of Apache Answer through 2.0.2 that host non-public questions with invited users are exposed to disclosure of those invite lists. The sources do not say which configurations or roles are needed beyond the described access path, so unknown beyond that.
No product ranges from the sources yet.
2.0.32.0.3 or later, which fixes the issueEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-68482")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.