Paper/Archive/CVE-2026-79624

CVE-2026-79624

Apache Software Foundation Apache Answer — Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation

EPSS 0.2%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (ADP)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 7.2.072 × 201.4 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Affected

ProductAffectedFixed inSource

Apache Answer≤ 2.0.2–CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

advisorylists.apache.org/thread/lpwc1hpnt3fkfwkh00v5j0dvpzqmnoqk refopenwall.com/lists/oss-security/2026/10/16/31