Authorization Flaw in Apache Answer by Apache
CVE-2026-71563

Currently unrated

Key Information:

Vendor

Apache
Status
Apache Answer
Vendor
CVE Published:
19 October 2026

What is CVE-2026-71563?

A significant vulnerability exists in Apache Answer, particularly in the MCP answer retrieval tool, which fails to appropriately restrict access. This allows individuals with a global API key to retrieve answer content linked to hidden, deleted, or questions under review, potentially exposing sensitive information. To mitigate this risk, it is crucial for users to upgrade to version 2.0.3, which resolves the identified issues.

Affected Version(s)

Apache Answer 0 <= 2.0.2

References

https://lists.apache.org/thread/msodd7g2r6xdn9wpkpdp04m9g...
vendor-advisory

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Han, JunGyu
VK, AzeFox Foundations
.