Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

Vulnerability Intelligence

Customers

GHSA-5w5r-8xc6-2xhw | Mondoo Vulnerability Intelligence

Vulnerability IntelligenceGHSA-5w5r-8xc6-2xhw

GHSA-5w5r-8xc6-2xhw

HIGH7.5

Apache Answer Exposure of Private Personal Information to an Unauthorized Actor vulnerability

Published Feb 4, 2026

Modified 1 months ago

Fix available

Details

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.7.1.

An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized users to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.

Affected Packages

github.com/apache/answer

Fixed in:

2.0.0

References

WEB

http://www.openwall.com/lists/oss-security/2026/02/04/1

ADVISORY

https://github.com/advisories/GHSA-5w5r-8xc6-2xhw

PACKAGE

https://github.com/apache/answer

WEB

https://lists.apache.org/thread/whxloom7mpxlyt5wzdskflsg5mzdzd60

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2026-24735

Aliases

CVE-2026-24735

CVSS Analysis

CVSS v4.0

6.6

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Attack Requirements

NoneAT:N

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

HighVC:H

Vuln. Integrity

NoneVI:N

Vuln. Availability

NoneVA:N

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

6.6/CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U

CVE-2026-24735

Ecosystems

Timeline

PublishedFeb 4, 2026

ModifiedFeb 4, 2026