As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-86589: Apache Answer: User Center integration does not revoke first-login sessions after central account suspension
Apache Answer through version 2.0.2 contains an authentication flaw in User Center integration where newly created external user sessions omit their external identity. This allows subsequent requests to bypass checks for central account suspension or deletion until the session expires.
Why it matters: Organizations running Apache Answer up to 2.0.2 should patch immediately: suspended or deleted central accounts can still access the system through existing sessions, creating an account takeover and privilege escalation risk.
- Source published
- First seen by Cybersecurity Tracker