CVE-2026-67249: Apache Answer accepts an email code in an unintended sensitive step

According to the advisory published on the oss-sec feed on 15 October, the flaw is rated moderate and affects Apache Answer up to version 2.0.2. A verification code issued for an email-based workflow could be accepted by another sensitive workflow, because the code's purpose was not properly validated. The described effect is account takeover. The advisory recommends upgrading to version 2.0.3, which fixes the issue. The text received is an automatic translation of the feed content; check the original advisory, the list of affected versions and the CVE identifier before deciding on actions. Relevance: this is a flaw in the application itself, not in the Rota Nacional platform. No Rota capability fixes or replaces the Apache Answer upgrade; whoever runs the software should verify the installed version and apply the fix through the internal change process. If your team uses AI to study the advisory, paste only the public text, never tokens, real email addresses, user data or production credentials.