{"id":"CVE-2026-79624","kind":"vulnerability","aliases":["CVE-2026-79624"],"related":[],"title":"Apache Answer: revoked users keep access to private uploads via stale token","description":"Insufficient session expiration vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\n\n\nInsufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.\n\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue.","summary":"Apache Answer does not fully invalidate sessions when a user is revoked, so a revoked user's old visit token still works. That lets the former user keep reading private uploaded files.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["apache-answer","package","self-hosted"],"not_affected_if":["no-private-uploads"],"how_to_check":"- Check the installed Apache Answer version and compare it with `2.0.3`\n- Review the deployment's Apache Answer version in the container image tag or package manifest","fix":"- Upgrade Apache Answer to `2.0.3` or later","status":"open","published_at":"2026-10-19T10:16:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:12:29+00:00","updated_at":"2026-10-25T05:12:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T05:12:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Apache Answer to `2.0.3` or later","reach":"internet","title":"Apache Answer: revoked users keep access to private uploads via stale token","impact":"medium","summary":"Apache Answer does not fully invalidate sessions when a user is revoked, so a revoked user's old visit token still works. That lets the former user keep reading private uploaded files.","category":"package","nicknames":[],"who_cares":["apache-answer","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"revoked former user reads private uploaded files","analyst_note":"","how_to_check":"- Check the installed Apache Answer version and compare it with `2.0.3`\n- Review the deployment's Apache Answer version in the container image tag or package manifest","needs_analyst":false,"not_affected_if":["no-private-uploads"],"who_is_affected":"Teams running Apache Answer up to and including `2.0.2` that store private uploaded files and remove or revoke user access. Installations with no private uploads or no user revocation are less exposed. The sources do not say whether managed hosting is affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000542,"input_tokens":3304,"output_tokens":423,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-79624':15A,18A '2.0.2':71C '2.0.3':97C 'access':6A,80C 'affect':67C 'allow':75C 'answer':2A,21B,27B,64C,69C 'apach':1A,20B,26B,63C,68C 'apache-answ':19B 'continu':79C 'cve':13A,16A 'expir':60C 'file':57B,84C 'fix':99C 'former':51B 'fulli':30B 'host':25B 'insuffici':58C,72C 'invalid':31B,74C 'issu':66C,101C 'keep':5A,53B 'known':81C 'let':49B 'old':43B 'packag':22B 'privat':8A,55B,82C 'read':54B 'recommend':92C 'revok':3A,37B,40B,76C 'self':24B 'self-host':23B 'session':32B,59C,73C 'stale':11A,87C 'still':46B 'token':12A,45B,89C 'upgrad':94C 'upload':9A,56B,83C 'user':4A,35B,41B,52B,77C,90C 'version':96C 'via':10A 'visit':44B,88C 'vulner':61C 'work':47B","nicknames":[],"mitigations":[],"who_affected":"Teams running Apache Answer up to and including `2.0.2` that store private uploaded files and remove or revoke user access. Installations with no private uploads or no user revocation are less exposed. The sources do not say whether managed hosting is affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T10:16:49+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-79624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-79624","severity":null,"published_at":"2026-10-19T10:16:49+00:00","modified_at":"2026-10-19T20:47:17+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}