Apache Answer
Approved changes feed: RSS · Atom
cpe:2.3:a:apache_software_foundation:apache_answer:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Apache Software Foundation (f563070d-e18f-561b-b86c-987936937e8a) |
|---|---|
| Product | Apache Answer (90e19b8c-d192-5add-b3a2-fc097a84ee74) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-50749 |
vulnerable | 2026-09-16 04:34:03.359681 |
Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions
Improper Authorization vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Published: 2026-08-05T15:11:05.448Z
Updated: 2026-08-06T15:27:21.369Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48912 |
vulnerable | 2026-09-16 04:33:04.921814 |
Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL
Improper Input Validation vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
A missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Published: 2026-08-05T15:10:08.165Z
Updated: 2026-08-06T14:37:55.288Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48834 |
vulnerable | 2026-09-16 04:33:04.749332 |
Apache Answer: Denial of service via crafted Accept-Language header parsing
Improper Handling of Length Parameter Inconsistency vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Published: 2026-08-05T15:07:35.440Z
Updated: 2026-08-06T14:35:47.589Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-48911 |
vulnerable | 2026-09-16 04:33:04.594285 |
Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow
Insufficient Verification of Data Authenticity vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Published: 2026-08-05T15:09:14.961Z
Updated: 2026-08-06T14:37:06.522Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-60023 |
vulnerable | 2026-09-16 04:32:44.457049 |
Apache Answer: Unauthorized disclosure of deleted or pending answer content
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing answer content that should not have been accessible.
Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Published: 2026-08-05T15:12:08.100Z
Updated: 2026-08-06T14:38:36.910Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-60053 |
vulnerable | 2026-09-16 04:32:43.995783 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34905 |
vulnerable | 2026-07-29 00:43:24.858608 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34033 |
vulnerable | 2026-07-29 00:43:23.520049 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-34031 |
vulnerable | 2026-07-29 00:43:23.518884 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33582 |
vulnerable | 2026-07-29 00:43:22.373256 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25700 |
vulnerable | 2026-07-29 00:34:57.248443 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25699 |
vulnerable | 2026-07-29 00:34:57.246066 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25688 |
vulnerable | 2026-07-29 00:34:57.196023 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-24735 |
vulnerable | 2026-06-08 07:51:18.093303 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-29868 |
vulnerable | 2026-06-08 07:14:56.879552 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-45719 |
vulnerable | 2026-06-08 06:48:08.948088 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41890 |
vulnerable | 2026-06-08 06:43:55.419774 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41888 |
vulnerable | 2026-06-08 06:43:55.413812 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-40761 |
vulnerable | 2026-06-08 06:43:53.138148 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-29217 |
vulnerable | 2026-06-08 06:33:29.024515 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-26578 |
vulnerable | 2026-06-08 06:31:26.500958 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-23349 |
vulnerable | 2026-06-08 06:29:37.340157 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-22393 |
vulnerable | 2026-06-08 06:29:34.815464 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-49619 |
vulnerable | 2026-06-08 06:14:29.260864 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.