HIGH🇵🇱 Wersja polska

CVE-2026-48911

CVSS 7.5pub. 2026-08-05upd. 2026-08-06

Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

  • Apache Answer

    APP
    Apache
    < 2.0.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2026-60053CRITICAL9.1PL ✓same product

Apache Answer: nieważne klucze API nadal aktywne po degradacji konta

CVE-2024-22393CRITICAL9.1PL ✓same product

Apache Answer — atak Pixel Flood przez nieograniczony upload pliku

CVE-2026-60023HIGH7.5PL ✓same product

Apache Answer: nieuprawniony dostęp do usuniętych/oczekujących odpowiedzi

CVE-2026-48834HIGH7.5PL ✓same product

Apache Answer — DoS przez nieprawidłowy nagłówek Accept-Language

CVE-2026-25700HIGH7.2same product

Improper Restriction of Security Token Assignment vulnerability in Apache Answer. This issue affects Apache A...