Apache Answer CVE-2026-79633

Requires a valid authenticated account on the Apache Answer instance (the vendor advisory explicitly states 'authenticated users'); note that the input provides no CVSS vector, so authentication level is not independently confirmed from a PR metric. The attacker must target specific non-public content objects, and exploitation is practically easiest on instances permitting open/self-service user registration. Limiting factors: no anonymous/pre-auth path, impact confined to content the authenticated user can reach via the missing check (mutations of non-public content rather than full account or host takeover), and instances restricting registration meaningfully raise the barrier to obtaining the required account.

This is a moderate-severity broken-access-control flaw in Apache Answer (versions through 2.0.2) where missing authorization checks let an already-authenticated user perform mutations on non-public content they should not reach. No CVSS vector, EPSS score, KEV listing, or POC was provided in the input, so quantitative exploitation signals are entirely absent - risk must be judged from the description alone. The vendor advisory explicitly scopes the flaw to authenticated users and to mutation of non-public content, which bounds impact well below a pre-auth RCE: an attacker needs a valid account on the target instance, and the damage is to data integrity/segregation rather than host compromise. There are no conflicting signals to reconcile because only the oss-security advisory and vendor page are available; the main caveat is that without a published CVSS vector the exact attack complexity and whether any confidentiality disclosure accompanies the mutations is not confirmed. Realistically this is a lower-priority issue than its presence in a security feed might suggest - patch during normal maintenance, prioritizing instances with open/self-service registration where obtaining an authenticated account is trivial.

An attacker registers or already holds a low-privileged account on a public Apache Answer instance (<=2.0.2), then issues API/application requests targeting content objects they are not authorized to modify. Because the server fails to enforce authorization on these mutation operations, the attacker alters or acts on private/non-public questions, answers, or related items belonging to other users. No public exploit code was identified at time of analysis; exploitation requires a valid authenticated session but no special user interaction from victims.