CVE-2026-79620

MediumCVSS 4.3/10Last modified Nov 3, 2026

Description

Exposure of sensitive information through data queries vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.2.

An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.

Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-202

Affected software

VendorProductVersions
Apache Software FoundationApache Answer<= 2.0.2

References

Timeline

Published
Oct 19, 2026
Last modified
Nov 3, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-796214.3The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it iCVE-2026-796227.3A weakness has been identified in dekdee adobe-xd-mcp 1.0.0. Impacted is an unknown function of the file src/parsers/xd-parser.ts of the comCVE-2026-796236.3A security vulnerability has been detected in FishCodeTech Muteki up to 0.2.5. The affected element is an unknown function of the file .clauCVE-2026-796249.8Insufficient session expiration vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Insufficient session CVE-2026-796258.1Affected products do not properly synchronize access to their monitoring functionality. When multiple clients send concurrent requests, thisCVE-2026-796277.1The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, CVE-2026-79638.3Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed a remote attacker who had compromised the rendCVE-2026-796305.3The WPFunnels WordPress plugin before 3.13.0 does not verify that the product requested through a checkout order bump is the product that bCVE-2026-796315.3The WPFunnels WordPress plugin before 3.13.0 does not restrict access to the log files it writes to a predictable location under the publicCVE-2026-796325.3The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, anCVE-2026-796338.1vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Missing authorization checks allowed authenticated usCVE-2026-796357.3Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Server-Side Reques
CVE-2026-79620: Medium severity, CVSS 4.3 | Vulnix