CVE-2026-68482

MediumCVSS 5.3/10Last modified Oct 30, 2026

Description

Missing Authorization vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

An unauthenticated or unauthorized user can retrieve the invited-user list associated with a non-public question due to missing visibility authorization checks.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Oct 19, 2026
Last modified
Oct 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-684849.0Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verifyCVE-2026-684854.3An authorization bypass in website-index.php in Revive Adserver 6.0.8 and earlier allows an authenticated manager restricted to one agency tCVE-2026-684865.4An authorization bypass in campaign-zone linking in Revive Adserver 6.0.8 and earlier allows an authenticated manager, or a trafficker with CVE-2026-684879.9Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.CVE-2026-684889.9A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to rootCVE-2026-684898.7Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to executCVE-2026-68498.8Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TUBITAK BILGEM Software TechnoloCVE-2026-684908.2Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.CVE-2026-684919.4An insufficient check allowed for the overwrite of arbitrary files via a symlink.CVE-2026-684928.7An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated usersCVE-2026-684933.1After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they arCVE-2026-684948.7The fix released in jackson-core 2.18.6 and 2.21.1 for CVE-2026-18401 (GHSA-72hv-8253-57qq, number length constraint bypass in the non-block
CVE-2026-68482: Medium severity, CVSS 5.3 | Vulnix