PT-2026-6207 · Apache · Apache Answer

Sho Odagiri · CVE-2026-24735 · Published 2026-02-04 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Answer versions through 1.7.1 github.com/apache/answer versions prior to 2.0.0

Description An issue exists in Apache Answer where an unauthenticated API endpoint incorrectly exposes the full revision history of deleted content. This allows an unauthorized user to retrieve restricted or sensitive information. Approximately 8.5K services are estimated to be affected worldwide. The vulnerable endpoint allows access to data that should be restricted.

Recommendations Upgrade to version 2.0.0 to resolve the issue for Apache Answer versions through 1.7.1. Upgrade to version 2.0.0 to resolve the issue for github.com/apache/answer versions prior to 2.0.0.

Exploit

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2026-24735

GHSA-5W5R-8XC6-2XHW

GO-2026-4421

OPENSUSE-SU-2026:21483-1

SUSE-SU-2026:0403-1

Affected Products

Apache Answer

References · 1753

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/24xxx/CVE-2026-24735.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-24735 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4421 · Vendor Advisory
• https://lists.apache.org/thread/whxloom7mpxlyt5wzdskflsg5mzdzd60 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5w5r-8xc6-2xhw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24735 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2026:21483-1 · Vendor Advisory
• https://github.com/apache/answer · Note
• https://suse.com/security/cve/CVE-2025-65797 · Note
• https://suse.com/security/cve/CVE-2026-44427 · Note
• https://suse.com/security/cve/CVE-2026-27589 · Note
• https://suse.com/security/cve/CVE-2026-7736 · Note
• https://suse.com/security/cve/CVE-2026-27137 · Note
• https://suse.com/security/cve/CVE-2026-25232 · Note