CVE-2026-71563: Apache Answer Authorization Bypass Flaw

CVE-2026-71563 is an authorization bypass vulnerability in Apache Answer allowing API key holders to access hidden, deleted, or pending-review question content. This article covers technical details, affected versions through 2.0.2, security impact, and mitigation steps including upgrading to version 2.0.3.

CVE-2026-71563 Overview

CVE-2026-71563 is a Missing Authorization vulnerability [CWE-862] in Apache Answer, affecting all versions through 2.0.2. The flaw resides in the Model Context Protocol (MCP) answer retrieval tool. Holders of a global API key can retrieve answer content tied to hidden, deleted, or pending-review questions. These answers should be gated by the question's visibility state, but the MCP endpoint does not enforce that check. Apache has released version 2.0.3 to resolve the issue.

Critical Impact
Authenticated API clients can read answer content that administrators have hidden, deleted, or placed into review, exposing moderated or private discussion data.

Affected Products

Apache Answer versions up to and including 2.0.2
Apache Answer MCP answer retrieval tool
Deployments exposing a global API key to third-party integrations

Discovery Timeline

2026-10-19 - CVE-2026-71563 published to the National Vulnerability Database (NVD)
2026-10-20 - Last updated in NVD database

Technical Details for CVE-2026-71563

Vulnerability Analysis

Apache Answer exposes a Model Context Protocol (MCP) tool for programmatic retrieval of answer content. The MCP answer retrieval endpoint validates the caller's global API key but does not re-check the authorization state of the parent question. As a result, the tool returns answer bodies linked to questions marked as hidden, soft-deleted, or pending moderator review. Content that is intentionally withheld from the normal web interface becomes reachable through the API surface. The issue is scoped to confidentiality; the vulnerability does not permit modification, deletion, or service disruption, according to the published CVSS vector.

Root Cause

The root cause is a missing authorization check [CWE-862] in the MCP answer retrieval handler. The handler evaluates API key possession as a sufficient trust signal and omits the state filter that the standard answer-fetch paths apply. Hidden, deleted, or pending-review questions remain queryable because their associated answers are not gated by the question lifecycle state.

Attack Vector

An attacker needs a valid global API key for the Apache Answer instance. The attacker calls the MCP answer retrieval tool over the network and references answers tied to moderated or non-public questions. The server returns the answer content without consulting the question's visibility rules. No user interaction is required, and the attack complexity is low. See the Apache Mailing List Discussion and the Openwall OSS Security Update for the vendor notice.

Detection Methods for CVE-2026-71563

Indicators of Compromise

API access logs showing MCP answer retrieval requests referencing question IDs that are marked hidden, deleted, or pending-review in the database.
Repeated MCP tool invocations from a single API key enumerating sequential or non-public answer identifiers.
Returned HTTP 200 responses on MCP answer endpoints for content that is inaccessible through the standard web UI.

Detection Strategies

Correlate Apache Answer application logs with question-state tables to flag MCP responses that leaked non-public content.
Baseline normal MCP tool usage per API key and alert on volume spikes or broad identifier scanning.
Audit all global API keys and compare their retrieval patterns against the integrations they were issued for.

Monitoring Recommendations

Forward Apache Answer access logs and MCP endpoint telemetry to a centralized analytics platform for retention and query.
Monitor for unauthorized use of global API keys, including requests originating from unexpected network ranges.
Alert on retrieval of answers tied to questions whose state is hidden, deleted, or pending.

How to Mitigate CVE-2026-71563

Immediate Actions Required

Upgrade Apache Answer to version 2.0.3, which contains the authorization fix.
Rotate all global API keys and audit which integrations hold them.
Review MCP endpoint access logs for retrieval of hidden, deleted, or pending-review answer content.
Restrict issuance of global API keys and prefer scoped credentials where available.

Patch Information

The Apache Answer project fixed the authorization gap in version 2.0.3. Operators should upgrade from any 2.0.2 or earlier release. Patch details are referenced in the Apache Mailing List Discussion and the Openwall OSS Security Update.

Workarounds

Disable the MCP answer retrieval tool if the deployment does not require it.
Place the Apache Answer API behind a reverse proxy that blocks or rate-limits MCP endpoints until the upgrade is applied.
Revoke global API keys that are not actively required by production integrations.
Restrict API access to known IP ranges to reduce exposure during the patch window.

bash

# Configuration example - upgrade Apache Answer to 2.0.3
docker pull apache/answer:2.0.3
docker stop answer && docker rm answer
docker run -d --name answer \
  -p 9080:80 \
  -v /var/data/answer:/data \
  apache/answer:2.0.3