PT-2026-47713 · Apache · Apache Answer

Sho Odagiri · CVE-2026-25699 · Published 2026-06-09 · Updated 2026-06-10

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Answer versions prior to 2.0.1

Description Timeline-related APIs lack proper authorization checks, which allows authenticated users to access content that is private, deleted, or unapproved, as well as its associated revision history. This leads to the exposure of private personal information to unauthorized actors.

Recommendations Upgrade to version 2.0.1.

Exploit

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2026-25699

GHSA-W754-5646-XQ9J

Affected Products

Apache Answer

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25699.json · Exploit
• https://lists.apache.org/thread/c36k4hzwhncqo0qfn5fg57f1gkjhyfv8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25699 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25699 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-w754-5646-xq9j · Vendor Advisory
• https://github.com/apache/answer/commit/92994b49976b6206a7000d045d924ec4fd5be1be · Note
• https://github.com/apache/answer/releases/tag/v2.0.1 · Note
• https://github.com/apache/answer · Note
• http://openwall.com/lists/oss-security/2026/06/09/6 · Note
• https://t.me/cveNotify/166833 · Telegram Post
• https://t.me/CVEtracker/56270 · Telegram Post
• https://t.me/cveNotify/166663 · Telegram Post