CVE-2026-24735

HIGH7.5

Apache Answer: Revision API Improper Access Control leads to Information Disclosure

Published Feb 4, 2026

Modified 4 weeks ago

Details

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.7.1.

An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.

References

WEB

http://www.openwall.com/lists/oss-security/2026/02/04/1

ADVISORY

https://lists.apache.org/thread/whxloom7mpxlyt5wzdskflsg5mzdzd60

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-24735

CVSS Analysis

CVSS v3.1

7.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Scope

UnchangedS:U

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

7.5/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness Type (CWE)

Other

CWE-359

Ecosystems

Timeline

PublishedFeb 4, 2026

ModifiedFeb 4, 2026