Apache Answer 2.0.3 Patch Fixes Metadata Leak Vulnerability

Apache Answer has released version 2.0.3 to address a moderate severity authorization vulnerability. The flaw, tracked as CVE-2026-79620, affected all versions of the software through 2.0.2 and allowed authenticated users to view metadata for non-public questions.

What happened

An official advisory posted to the oss-security mailing list on October 15 detailed the security issue in Apache Answer. The report identified an improper authorization check within the similar-question search functionality. This oversight meant that users who had authenticated access could retrieve metadata associated with questions that were not intended to be public. The vulnerability is classified as having a moderate severity rating.

According to the advisory, the issue stems from a failure to properly restrict data queries. This allowed for the exposure of sensitive information that should have remained hidden from standard user views. The researcher credited with discovering the flaw is n0mi1k. The advisory explicitly states that the problem affects the entire version range up to and including 2.0.2.

Why it matters

The advisory recommends upgrading to Apache Answer version 2.0.3 to address the authorization bypass. Users running any version prior to this release are exposed to the risk of metadata leakage. The vulnerability affects authenticated users, who could potentially exploit the search feature to gather restricted data.

This type of information disclosure involves the exposure of sensitive information through data queries. The vendor recommends upgrading to the patched version to eliminate the risk. Since the fix is available, teams managing Apache Answer instances should verify their current version status immediately. The advisory notes that the issue allows for the disclosure of non-public question metadata.

What to watch

• Monitor internal logs for unusual search activity that might indicate exploitation of the similar-question feature.
• Check for any unexpected access patterns to non-public question metadata by authenticated users.
• Verify that the upgrade to version 2.0.3 completes successfully without breaking existing search integrations.
• Review access controls to ensure that sensitive metadata remains protected after the patch is applied.

Who needs to act first

Teams should prioritize updating systems that host sensitive or confidential question data. Organizations with high numbers of authenticated users face greater exposure risk and should move quickly. Before applying the patch, administrators should back up their current configuration and database. It is advisable to test the upgrade in a staging environment to ensure compatibility with existing plugins or custom search filters. If immediate patching is not possible, restrict access to the search feature where feasible. Monitor user activity closely for signs of unauthorized data retrieval. Coordinate with security teams to validate that the new version enforces proper authorization checks.

What to do and how to stay safe: Apache Answer

• Inventory all servers and containers running Apache Answer to identify instances using versions through 2.0.2.
• Schedule an immediate upgrade to version 2.0.3 during a maintenance window to minimize service disruption.
• Review audit logs from the period before the patch to detect any potential unauthorized access to private metadata.
• Verify that the similar-question search functionality operates correctly and respects access controls after the update.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Apache Answer are affected by CVE-2026-79620?

All versions of Apache Answer through 2.0.2 are affected by this vulnerability.

Is there a fix available for this authorization flaw?

Yes, users are recommended to upgrade to version 2.0.3, which fixes the issue.

What kind of data can be exposed through this vulnerability?

Authenticated users can view metadata of non-public questions through the similar-question search.