Apache Answer has an insufficient session invalidation flaw that allows tokens for revoked users to remain usable. Revoked users can still request and download private files that were uploaded by others, bypassing access controls and potentially disclosing data protected by the application. The underlying weakness is an insufficient session expiration check, identified as CWE‑613.

The flaw affects Apache Answer versions up through 2.0.2. Users running 2.0.2 or earlier are vulnerable; the vendor recommends upgrading to 2.0.3 where the token expiration logic is corrected.

The vulnerability can be exploited by reusing a stale visit token after a user’s session has been revoked. The CVSS score of 9.8 indicates a critical severity, and the EPSS score of < 1% suggests limited current exploitation. The direct data disclosure risk is significant because the flaw allows authorized access to data the application designates as private. This issue is not listed in the CISA KEV catalog, but the high CVSS emphasizes the importance of applying the patch promptly.