Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Answer

37 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Critical 9.8
    CVE-2026-90910

    Apache Answer: Reaction API authorization bypass for restricted content

    Missing authentication for critical function vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The reaction API did not enforce content visibility controls, allowing unauthorized users to read reaction metadata from restricted c…

    Apache Software Foundation Apache Answer
  • Critical 9.8
    CVE-2026-79624

    Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation

    Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are rec…

    Apache Software Foundation Apache Answer
  • Critical 9.1
    CVE-2026-60053

    Apache Answer: Residual Administrative API Key Access After Role or Account Revocation

    Insufficient Session Expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Administrative API keys remained usable after the owning administrator was demoted or the account was marked inactive, suspended, or deleted, allo…

    Apache Software Foundation Apache Answer
  • Critical 9.1
    CVE-2024-22393 Public exploit

    Apache Answer: Pixel Flood Attack by uploading the large pixel file

    Unrestricted Upload of File with Dangerous Type vulnerability in Apache Answer.This issue affects Apache Answer: through 1.2.1. Pixel Flood Attack by uploading large pixel files will cause server out of memory. A logged-in user can cause such an attack by upl…

    Apache Software Foundation Apache Answer github.com/apache/incubator-answer Go