Apache Answer has an insufficient session invalidation flaw that allows tokens for revoked users to remain usable. Revoked users can still request and download private files that were uploaded by others, effectively bypassing access controls and leaking restricted data. The underlying weakness is an insufficient session expiration check, identified as CWE‑613.

The flaw affects Apache Answer versions up through 2.0.2. Users running 2.0.2 or earlier are vulnerable; the vendor recommends upgrading to 2.0.3 where the token expiration logic is corrected.

The vulnerability can be exploited by reusing a stale visit token after a user’s session has been revoked. While no CVSS or EPSS score is published, the direct data disclosure risk is significant because private uploads may contain confidential information. No exploit is listed in CISA KEV, but the lack of a formal score means defenders should treat it as a high‑risk issue and apply the fix promptly.