CVE-2026-71563 Details
Description
Missing Authorization vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An authorization flaw in the MCP answer retrieval tool allows holders of a global API key to access answer content associated with hidden, deleted, or pending-review questions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.
A missing authorization vulnerability has been identified in Apache Answer versions through 2.0.2. This issue allows holders of a global API key to access answer content related to hidden, deleted, or pending-review questions, due to an authorization flaw in the MCP answer retrieval tool.
Users are advised to upgrade to Apache Answer version 2.0.3, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/10/16/27 | CVE | AdvisoryMailing ListRemedy |
| https://lists.apache.org/thread/msodd7g2r6xdn9wpkpdp04m9g1jb2xtl | [email protected] | AdvisoryMailing ListRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Apache Answer | <= 2.0.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | CVE Modified | CVE |
| Oct 19, 2026 | New CVE Received | [email protected] |