CVE-2026-79613: Apache Answer exposes comments on non-public content through public profiles
A moderate-severity flaw in Apache Answer up to version 2.0.2 let unauthenticated attackers access comments tied to non-public content through public user profiles. The fix is in version 2.0.3.
According to the advisory relayed through the oss-sec feed, CVE-2026-79613 affects Apache Answer up to version 2.0.2. Unauthenticated attackers could see comments associated with content that was not public, using public user profiles as the access path. The advisory was published on October 15 and rates the severity as moderate. Credit for the discovery goes to a researcher identified by a handle.
The advisory recommends upgrading to version 2.0.3, which fixes the issue. This text is an automatic translation of the original advisory, so for exact technical details, consult the official source listed in the Apache Answer project references.
Rota Nacional is an AI platform with an API compatible with OpenAI and Anthropic. It does not operate or patch Apache Answer and does not replace the software update. This item is a third-party security advisory and does not describe a Rota feature.