Yangxi

**Name of the Vulnerable Software and Affected Versions** Apache Answer versions prior to 2.0.2 **Description** Insufficient Verification of Data Authenticity in the external-login email binding flow. A missing authorization check allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link. **Recommendations** Upgrade to version 2.0.2.

**Name of the Vulnerable Software and Affected Versions** Apache Answer versions prior to 2.0.2 **Description** Unauthorized users can retrieve the content of deleted or pending answers through the single-answer read path, provided the parent question remains visible. This leads to the exposure of sensitive information that should be inaccessible. **Recommendations** Upgrade to version 2.0.2.

**Name of the Vulnerable Software and Affected Versions** Apache Answer versions prior to 2.0.2 **Description** Insufficient Session Expiration allows administrative API keys to remain active even after the associated administrator account is demoted, marked as inactive, suspended, or deleted. This results in unauthorized continued access to administrative functions until the keys are manually removed. **Recommendations** Upgrade to version 2.0.2.