Insufficient Session Expiration in Apache Answer by Apache

CVE-2026-79624

What is CVE-2026-79624?

The Apache Answer application has a vulnerability related to insufficient session expiration. This flaw allows revoked users to maintain access to sensitive uploaded files by using stale visit tokens. The affected versions up to 2.0.2 do not properly handle session invalidation, increasing the risk of unauthorized file access. Users should promptly upgrade to version 2.0.3 to mitigate this risk and protect confidential data.

References