Apache Answer: Unauthorized disclosure of deleted or pending answer content

published 2026-08-05 3 mo ago modified 2026-10-24 15 d ago also EUVD-2026-53401

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing answer content that should not have been accessible. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Patch / fix

fixed in 1

apache answer 2.0.2

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 3 mo ago (2026-08-06)

Exploit prediction

0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Apache Software Foundation Apache Answer

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

lists.apache.org /thread/rq3ygd0j9cchkbmh99dqf8624s7r8y49
vendor-advisory, mailing-list
openwall.com /lists/oss-security/2026/08/05/13
mailing-list, third-party-advisory

Sources

CVE List CVE-2026-60023
NVD CVE-2026-60023

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary