Apache Answer vulnerabilities

• apache answer Apache Answer: Residual Administrative API Key Access After Role or Account Revocation CVE-2026-60053 9.1 CriticalAugust 5, 2026
• apache answer Apache Answer: Unauthorized disclosure of deleted or pending answer content CVE-2026-60023 7.5 HighAugust 5, 2026
• apache answer Apache Answer: Missing authorization in revision audit reject allows authenticated users to reject pending revisions CVE-2026-50749 6.5 MediumAugust 5, 2026
• apache answer Apache Answer: Improper authorization in avatar update cleanup allows authenticated users to delete arbitrary uploaded files by URL CVE-2026-48912 6.5 MediumAugust 5, 2026
• apache answer Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow CVE-2026-48911 7.5 HighAugust 5, 2026
• apache answer Apache Answer: Denial of service via crafted Accept-Language header parsing CVE-2026-48834 7.5 HighAugust 5, 2026
• apache answer Apache Answer: AdminToken not invalidated after admin deactivation CVE-2026-25700 Fix available 7.2 HighJune 10, 2026
• apache answer Apache Answer: Unlisted Questions Accessible via Direct API Access CVE-2026-34905 Fix available 6.5 MediumJune 9, 2026
• apache answer Apache Answer: HTML Content Injection in Email CVE-2026-34033 Fix available 5.4 MediumJune 9, 2026
• apache answer Apache Answer: The custom avatar was not properly validated CVE-2026-34031 Fix available 6.5 MediumJune 9, 2026
• apache answer Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error CVE-2026-33582 Fix available 6.5 MediumJune 9, 2026
• apache answer Apache Answer: Authorization Bypass in Timeline API CVE-2026-25699 Fix available 6.1 MediumJune 9, 2026
• apache answer Apache Answer: XSS in AI Answer Rendering CVE-2026-25688 Fix available 6.1 MediumJune 9, 2026
• apache answer Apache Answer: Revision API Improper Access Control leads to Information Disclosure CVE-2026-24735 Fix available 7.5 HighFebruary 4, 2026
• apache answer Apache Answer: Using externally referenced images can leak user privacy. CVE-2025-29868 Fix available 6.5 MediumApril 1, 2025
• apache answer Apache Answer: Predictable Authorization Token Using UUIDv1 CVE-2024-45719 Fix available 2.6 LowNovember 22, 2024
• apache answer Apache Answer: Avatar URL leaked user email addresses CVE-2024-40761 Fix available 5.3 MediumSeptember 25, 2024
• apache answer Apache Answer: The link for resetting user password is not Single-Use CVE-2024-41888 Fix available 5.3 MediumAugust 9, 2024
• apache answer Apache Answer: The link to reset the user's password will remain valid after sending a new link CVE-2024-41890 Fix available 5.3 MediumAugust 9, 2024
• apache answer Apache Answer: XSS vulnerability when changing personal website CVE-2024-29217 Fix available 4.6 MediumApril 21, 2024
• apache answer Apache Answer: Pixel Flood Attack by uploading the large pixel file CVE-2024-22393 Public exploitFix available 9.1 CriticalFebruary 22, 2024
• apache answer Apache Answer: XSS vulnerability when submitting summary CVE-2024-23349 Fix available 5.4 MediumFebruary 22, 2024
• apache answer Apache Answer: Repeated submission at registration created duplicate users with the same name CVE-2024-26578 Fix available 5.9 MediumFebruary 22, 2024
• apache answer Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions. CVE-2023-49619 Fix available 3.1 LowJanuary 10, 2024