Live › vulnerability › CVE-2026-79624
Go to dashboardApache Answer does not fully invalidate sessions when a user is revoked, so a revoked user's old visit token still works. That lets the former user keep reading private uploaded files.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running Apache Answer up to and including 2.0.2 that store private uploaded files and remove or revoke user access. Installations with no private uploads or no user revocation are less exposed. The sources do not say whether managed hosting is affected.
No product ranges from the sources yet.
2.0.32.0.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Insufficient session expiration vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-79624")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.