CVE-2026-86589

Apache Answer through 2.0.2 has a missing authorization checks vulnerability. Authenticated users could perform actions on non-public content they were not permitted to access.

Apache Answer through 2.0.2 has an insufficient session expiration vulnerability. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.

Apache Answer through 2.0.2 has an exposure of sensitive information through data queries vulnerability. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.

In Apache Answer through 2.0.2, unauthenticated attackers could access comments associated with non-public content through public user profiles. The flaw stems from insufficient visibility checks on comments.

In Apache Answer through 2.0.2, unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. This is an exposure of sensitive information to unauthorized actors.

In Apache Answer through 2.0.2, an authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions.

In Apache Answer through 2.0.2, an unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.

In Apache Answer through 2.0.2, a verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.

In Apache Answer through 2.0.2, the question operation controller gates hide/show operations on the wrong permission check (unpin instead of hide). In custom role configurations separating these permissions, a user granted only question.unpin can hide or restore questions without holding question.hide or question.show.

In Apache Answer through 2.0.2, the importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path. Attacker-controlled HTML embedded in an imported data source is persisted and rendered to all viewers, including privileged users, as stored XSS.