{"id":"CVE-2026-68482","kind":"vulnerability","aliases":["CVE-2026-68482"],"related":[],"title":"Apache Answer: missing check exposes invited-user lists of private questions","description":"Missing Authorization vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nAn unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","summary":"Apache Answer through 2.0.2 fails to check visibility permissions before returning the invited-user list for a non-public question. An unauthenticated or unauthorized user can read which accounts were invited to those questions.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-answer","package","self-hosted"],"not_affected_if":["already-on-2.0.3"],"how_to_check":"- Check the installed Apache Answer version and compare it against `2.0.3`\n- unknown","fix":"- Upgrade Apache Answer to `2.0.3` or later, which fixes the issue","status":"open","published_at":"2026-10-19T10:16:48+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:32+00:00","updated_at":"2026-10-25T05:12:32+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:12:32Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Answer to `2.0.3` or later, which fixes the issue","reach":"internet","title":"Apache Answer: missing check exposes invited-user lists of private questions","impact":"low","summary":"Apache Answer through 2.0.2 fails to check visibility permissions before returning the invited-user list for a non-public question. An unauthenticated or unauthorized user can read which accounts were invited to those questions.","category":"package","nicknames":[],"who_cares":["apache-answer","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker reads invited-user lists for private questions","analyst_note":"Confirm whether unauthenticated access is possible or only unauthorized logged-in users, and check the Apache Answer 2.0.3 release notes for the fix commit.","how_to_check":"- Check the installed Apache Answer version and compare it against `2.0.3`\n- unknown","needs_analyst":true,"not_affected_if":["already-on-2.0.3"],"who_is_affected":"Deployments of Apache Answer through 2.0.2 that host non-public questions with invited users are exposed to disclosure of those invite lists. The sources do not say which configurations or roles are needed beyond the described access path, so unknown beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000572,"input_tokens":3308,"output_tokens":483,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-68482':15A,18A '2.0.2':29B,74C '2.0.3':107C 'account':56B 'affect':70C 'answer':2A,21B,27B,67C,72C 'apach':1A,20B,26B,66C,71C 'apache-answ':19B 'associ':87C 'author':63C,98C 'check':4A,32B,99C 'cve':13A,16A 'due':94C 'expos':5A 'fail':30B 'fix':109C 'host':25B 'invit':7A,39B,58B,84C 'invited-us':6A,38B,83C 'issu':69C,111C 'list':9A,41B,86C 'miss':3A,62C,96C 'non':45B,91C 'non-publ':44B,90C 'packag':22B 'permiss':34B 'privat':11A 'public':46B,92C 'question':12A,47B,61B,93C 'read':54B 'recommend':102C 'retriev':81C 'return':36B 'self':24B 'self-host':23B 'unauthent':49B,76C 'unauthor':51B,78C 'upgrad':104C 'user':8A,40B,52B,79C,85C,100C 'version':106C 'visibl':33B,97C 'vulner':64C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Apache Answer through 2.0.2 that host non-public questions with invited users are exposed to disclosure of those invite lists. The sources do not say which configurations or roles are needed beyond the described access path, so unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-68482","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-68482","severity":null,"published_at":"2026-10-19T10:16:48+00:00","modified_at":"2026-10-19T20:47:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}