Apache Answer allows authenticated users to embed arbitrary HTML in email notifications. The application fails to neutralize script‑related tags before inserting user data, enabling the injection of malicious HTML content into outbound emails. When recipients view these emails, the embedded content can execute in their email client, potentially leading to data theft, credential compromise, or further phishing attacks. This flaw is a classic example of cross‑site scripting in an email context.

Apache Software Foundation’s Apache Answer, affected versions up to and including 2.0.0. Users must verify their deployment version; the fix is available in 2.0.1 and later.

The CVSS score is 5.4, indicating moderate severity. The EPSS score is less than 1%, suggesting a low exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to a target system and able to send notification emails, making the threat vector internal but still significant for organizations that rely on Apache Answer for user communications.