Apache Answer permits authenticated users to embed arbitrary HTML in notification emails. The application does not neutralize script-related tags before inserting user-supplied data, so an attacker can inject malicious HTML. When recipients open the email, the injected content can execute within the email client, potentially stealing data, hijacking session state, or redirecting users to phishing sites. This is a classic cross-site scripting flaw, represented by CWE‑79 and CWE‑80.

The flaw affects Apache Software Foundation’s Apache Answer through version 2.0.0. Deployments running any of those releases are vulnerable until a patch is applied or the application is upgraded to 2.0.1 or later.

The CVSS score of 5.4 indicates moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated to the system and able to trigger notification emails, so the vector is internal but still significant for organizations that rely on Apache Answer for internal communications.