CVE-2026-48911

CVE-2026-48911: Apache Answer: Unauthenticated OAuth Email-Binding Account Takeover via Existing User Confirmation Flow

Vendor Apache Software Foundation

Product Apache Answer

Weakness CWE-306 · Missing auth

Published August 5, 2026

Last update August 5, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Insufficient Verification of Data Authenticity vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. A missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Key dates

02Disclosure timeline

August 5, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-48911 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/306.html AskarLabs — CWE-306 write-up Missing Authentication for Critical Function

Related vulnerabilities

04Related CVE

CVE-2025-7045 Cloud SAML SSO <= 1.0.19 - Missing Authorization to Unauthenticated Identity Provider Deletion via delete_config Action CVE-2025-7031 Config Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-086 CVE-2025-10746 Integrate Dynamics 365 CRM <= 1.0.9 - Missing Authorization CVE-2018-25335 WordPress Plugin Peugeot Music 1.0 Arbitrary File Upload CVE-2026-0942 Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit <= 5.1.5 - Missing Authorization to Unauthenticated Rede Order Logs Deletion