According to the curated text, the vulnerability was published on the oss-sec list on 15 October and rated moderate. It affects Apache Answer up to version 2.0.2. Insufficient session invalidation lets revoked users keep accessing known private files with an outdated visitor token. The advisory recommends upgrading to version 2.0.3, which fixes the issue, and credits a researcher for the report. The text is a machine translation; the original is the public record on the oss-sec list, which you can find by the identifier CVE-2026-79624.
Organizations using Apache Answer for knowledge bases, communities or portals with private attachments should check the installed version, apply 2.0.3, and review active sessions and tokens for users who have already been removed. This is administration of the software itself; Rota Nacional does not host, patch or manage Apache Answer.
If your team uses AI to study the advisory or plan the upgrade, do not paste tokens, cookies, private file names, internal addresses or user data. Rota's barrier detects personal data before any model runs, but credentials should be removed by the person sending the text and should not rely on that detection.