CVE-2026-67249

critical

Description

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

References

https://lists.apache.org/thread/kbdgj9vzd24zb4r2d9ydqyr6f70rpg0v

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-104156

http://www.openwall.com/lists/oss-security/2026/10/16/25

Details

Source: Mitre, NVD

Published: 2026-10-19

Updated: 2026-10-19

Risk Information

CVSS v2

Base Score: 6.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 9.1

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Severity: Critical

EPSS

EPSS: 0.00176