CVE-2026-67249 Details
Description
A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
A vulnerability exists in Apache Answer versions prior to 2.0.2, where verification codes from one email-based workflow could be improperly accepted by another sensitive workflow. This issue arises because the specific purpose of the codes was not adequately enforced, potentially allowing for unauthorized actions or access. Users are advised to upgrade to version 2.0.3, which addresses this vulnerability.
Users should upgrade to Apache Answer version 2.0.3 or later, which resolves this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 26, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/10/16/25 | CVE | AdvisoryMailing ListRemedy |
| https://lists.apache.org/thread/kbdgj9vzd24zb4r2d9ydqyr6f70rpg0v | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Answer | <= 2.0.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 26, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | CVE Modified | CVE |
| Oct 19, 2026 | New CVE Received | [email protected] |