PT-2026-68187 · Apache · Apache Answer

Tonghuaroot

+1

·

CVE-2026-48911

·

Published

2026-08-05

·

Updated

2026-08-06

CVSS v3.1

7.5

High

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.2
Description Insufficient Verification of Data Authenticity in the external-login email binding flow. A missing authorization check allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link.
Recommendations Upgrade to version 2.0.2.

Exploit

Fix

Missing Authentication

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-48911

Affected Products

Apache Answer