CVE-2026-67249

Published: Oct 19, 2026Modified: Oct 19, 2026Deferred

Description

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Related CWEs

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

References (2)

https://lists.apache.org/thread/kbdgj9vzd24zb4r2d9ydqyr6f70rpg0v

Source: security@apache.org

http://www.openwall.com/lists/oss-security/2026/10/16/25

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.