CVE-2026-48911

HighCVSS 7.5/10Last modified Oct 24, 2026

Description

Insufficient Verification of Data Authenticity vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-306

Affected software

No affected versions have been published.

Timeline

Published
Aug 5, 2026
Last modified
Oct 24, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-489126.5Improper Input Validation vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing ownership check in tCVE-2026-489137.3Use After Free vulnerability in Apache HTTP Server module mod_http2 when file handles are already exhausted. This issue affects Apache HTTPCVE-2026-489146.7A flaw was found in QEMU's virtio-blk device. The issue arises because the device does not properly validate the size of input descriptors bCVE-2026-489166.6Jenkins LDAP Plugin 807.v7d7de30930cf and earlier follows LDAP referrals.CVE-2026-489176.6Jenkins LDAP Plugin 807.v7d7de30930cf and earlier deserializes data from LDAP referrals without validation.CVE-2026-489186.6Jenkins Active Directory Plugin 2.41 and earlier follows LDAP referrals by default.CVE-2026-489196.6Jenkins Active Directory Plugin 2.41 and earlier deserializes data from LDAP referrals without validation.CVE-2026-48928.4A heap-based out-of-bounds write vulnerability in the DHCPv6 implementation of dnsmasq allows local attackers to execute arbitrary code withCVE-2026-489208.8Jenkins Email Extension Plugin 1933.v45cec755423f and earlier allows inlining images as `base64` in email content by setting the `data-inlinCVE-2026-489217.5Jenkins Pipeline: Groovy Libraries Plugin 797.v90ea_a_9b_e45a_0 and earlier does not prohibit symbolic links in shared libraries, allowing aCVE-2026-489227.5Jenkins Credentials Binding Plugin 720.v3f6decef43ea_ and earlier does not properly sanitize file names for file and zip file credentials, aCVE-2026-489234.3Jenkins AppSpider Plugin 1.0.17 and earlier does not perform a permission check in a method implementing form validation, allowing attackers