CVE-2026-79624— Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
Quick assessment
Affected
Apache Software Foundation Apache Answer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Apache Answer 存在会话过期机制不足的漏洞。 该问题影响 Apache Answer 2.0.2 及更早版本。 由于会话失效处理不充分，已被撤销权限的用户仍可凭借过期的访问令牌继续访问已知的私有上传文件。 建议用户升级至 2.0.3 版本，该版本已修复此问题。
Possible ATT&CK Techniques 1 AI
T1558.003 · KerberoastingAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Answer | ≤ 2.0.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-79624
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation
Source: CVE Program / CVE List V5
Vulnerability Description
Insufficient session expiration vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
Insufficient session invalidation allowed revoked users to continue accessing known private uploaded files with a stale visit token.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Answer | 0 ~ 2.0.2 | - |
|
II. Public POCs for CVE-2026-79624
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-79624
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-79624 (1)
Same Patch Batch · Apache Software Foundation · 2026-10-19 · 62 CVEs total
| CVE-2026-78162 | 10.0 CRITICAL | Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incom |
| CVE-2026-88900 | 8.8 HIGH | Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroup |
| CVE-2026-83531 | 8.8 HIGH | Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplie |
| CVE-2026-78165 | 8.8 HIGH | Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads |
| CVE-2026-80312 | 8.2 HIGH | Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors |
| CVE-2026-80344 | 8.2 HIGH | Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchro |
| CVE-2026-80343 | 8.2 HIGH | Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path |
| CVE-2026-78164 | 8.2 HIGH | Apache Camel: HTTP producers resolve property placeholders in message-supplied URI overrid |
| CVE-2026-88901 | 8.2 HIGH | Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by d |
| CVE-2026-85251 | 7.5 HIGH | Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets |
| CVE-2026-85250 | 7.5 HIGH | Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the docum |
| CVE-2026-79984 | 7.4 HIGH | Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name repo |
| CVE-2026-79985 | 7.4 HIGH | Apache Camel: camel-smb resolved the remote path of a polled file from the name reported i |
| CVE-2026-79986 | 7.4 HIGH | Apache Camel: camel-azure-files resolved the remote path of a polled file from the name re |
| CVE-2026-79983 | 7.4 HIGH | Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported i |
| CVE-2026-91858 | 6.5 MEDIUM | Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input Wh |
| CVE-2026-84176 | 6.5 MEDIUM | Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Orig |
| CVE-2026-85249 | 6.5 MEDIUM | Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata |
| CVE-2026-85254 | 6.5 MEDIUM | Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name |
| CVE-2026-85314 | 6.5 MEDIUM | Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMult |
Showing top 20 of 62 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Apache Answer
-
CVE-2026-90910
Apache Answer: Reaction API authorization bypass for restric -
CVE-2026-86589
Apache Answer: User Center integration does not revoke first -
CVE-2026-79633
Apache Answer: Missing Authorization Allows Mutations of Non -
CVE-2026-79620
Apache Answer: Improper Authorization Allows Disclosure of N -
CVE-2026-79613
Apache Answer: Disclosure of Comments on Non-Public Content
Same vendor: Apache Software Foundation
-
CVE-2026-107755
Apache CouchDB: Credential Disclosure to Non-Owner Members v -
CVE-2026-90800
Apache CouchDB: Auth bypass in prefixed _users and _replicat -
CVE-2026-90799
Apache CouchDB: Atom-table exhaustion in _changes sequences -
CVE-2026-90798
Apache CouchDB: Replicator follows redirects indefinitely -
CVE-2026-90797
Apache CouchDB: Pre-authentication gzip decompression bomb v
Same weakness: CWE-613
-
CVE-2025-36069
TS4500 Tape Library Insufficient Session Expiration -
CVE-2025-36252
TS4500 Tape Library Insufficient Session Expiration -
CVE-2025-13173
Improper Token Revocation via Session-Bound Token Flow in Mu -
CVE-2026-12254
Netskope Client Captive Portal WebView Persistence allowing -
CVE-2026-110024
@fastify/jwt vulnerable to missing token expiration when per
V. Comments for CVE-2026-79624
No comments yet