CVE-2026-67249

Full vulnerability record from the local CVENow database.

Description

A vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. A verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

Severity

MEDIUM

CVSS score

5.4 (v3.1)

Vulnerability status

Deferred

Source identifier

[email protected]

Published

2026-10-19 10:16:48.397000

Last modified

2026-10-26 14:16:39.117000

View original CVE JSON

{
  "id": "CVE-2026-67249",
  "sourceIdentifier": "[email protected]",
  "published": "2026-10-19T10:16:48.397",
  "lastModified": "2026-10-26T14:16:39.117",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability in Apache Answer.\n\n\n\nThis issue affects Apache Answer: through 2.0.2.\n\nA verification code issued for one email-based workflow could be accepted by another sensitive workflow because the code purpose was not properly enforced.\n\n\nUsers are recommended to upgrade to version 2.0.3, which fixes the issue."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "Apache Software Foundation",
          "product": "Apache Answer",
          "defaultStatus": "unaffected",
          "packageURL": "pkg:software-id/apache.org/answer",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "2.0.2",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-10-26T13:41:03.605893Z",
          "id": "CVE-2026-67249",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-863"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://lists.apache.org/thread/kbdgj9vzd24zb4r2d9ydqyr6f70rpg0v",
      "source": "[email protected]"
    },
    {
      "url": "http://www.openwall.com/lists/oss-security/2026/10/16/25",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}