As cited
Copy frozen at (site build).
vulnerabilities
CVE-2026-79624: Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
Apache Answer versions through 2.0.2 contain an insufficient session expiration vulnerability that allows revoked users to access private uploaded files using stale visit tokens. The issue stems from incomplete session invalidation after user revocation. Upgrading to version 2.0.3 resolves the vulnerability.
Why it matters: Organizations running Apache Answer through 2.0.2 risk unauthorized access to private uploads from former users or those whose sessions should have been revoked; immediate patching to 2.0.3 is required to prevent continued file access.
- Source published
- First seen by Cybersecurity Tracker