Apache Answer CVE-2026-67249

Exploitation requires that the deployment uses Apache Answer's email-code-based workflows and that an attacker can obtain or replay a verification code issued for a different (less sensitive) email workflow, then present it to a sensitive workflow that does not validate the code's original purpose. The limiting factors: the attacker must possess a currently valid verification code and target a specific account's workflow, so this is not a trivial single-request remote compromise; it depends on the code-issuance and reuse timing rather than on any non-default configuration. Affected only through version 2.0.2 - upgrading to 2.0.3 removes the condition by enforcing code purpose. Authentication requirements not confirmed from available data because no CVSS vector was provided.

This is an authentication-logic flaw (email verification code purpose confusion) in Apache Answer through 2.0.2, rated moderate by the project. Critically, NO CVSS vector, EPSS score, KEV listing, SSVC decision, or POC was provided in the input - so quantitative exploitation signals are entirely ABSENT and cannot be cross-referenced. On available signals alone: there is no evidence of active exploitation (not in CISA KEV) and no public exploit identified, which argues against treating this as an emergency. However, the technical impact is severe when triggered - a code issued for one email workflow being accepted by another sensitive workflow can lead to full account takeover, which affects confidentiality and integrity of the victim account. The realistic priority is MODERATE: high impact but exploitation appears to require specific conditions (obtaining or reusing a valid verification code in a cross-workflow manner) rather than trivial remote compromise. Note the tension between the vendor's 'moderate' rating and the account-takeover outcome - my independent assessment (below) lands in the High band; this discrepancy likely reflects the vendor weighting the non-trivial preconditions for abusing the code. Verify exact exploitation preconditions with the Apache Answer security advisory, which was not fully available in this input.

An attacker obtains a verification code that Apache Answer issued for one email-based workflow (for example a benign email verification or confirmation step) and submits it to a different, more sensitive workflow (such as account recovery or credential change) that fails to enforce the code's original purpose. Because the code's intended context is not validated, the sensitive workflow accepts it and the attacker gains control of the targeted account. No public exploit code was identified at the time of analysis.