CVE-2026-79620: Apache Answer exposes metadata of non-public questions
An improper authorization check in the similar-questions search let authenticated users view metadata of non-public questions in Apache Answer up to version 2.0.2. The fix is in version 2.0.3. The original advisory rates the severity as moderate.
According to the advisory published on the oss-sec feed on October 15, 2026, vulnerability CVE-2026-79620 affects Apache Answer up to version 2.0.2, with severity rated as moderate. An improper authorization check in the similar-questions search allowed authenticated users to view metadata of questions that were not public. The available text is a machine translation of the original advisory and classifies the issue as exposure of sensitive information.
The advisory recommends updating to version 2.0.3, which fixes the problem. To check the original content, consult the advisory in the public archive of the oss-sec list, as indicated in the source, and confirm the version installed on your instance. This piece does not describe technical details of the fix or measure real exposure at third parties. Rota Nacional is not the component affected by this flaw.