PT-2026-6207 · Apache · Apache Answer

Sho Odagiri · Published 2026-02-04 · Updated 2026-02-09 · CVE-2026-24735

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Answer versions through 1.7.1 github.com/apache/answer versions prior to 2.0.0

Description An issue exists in Apache Answer where an unauthenticated API endpoint incorrectly exposes the full revision history of deleted content. This allows an unauthorized user to retrieve restricted or sensitive information. Approximately 8.5K services are estimated to be affected worldwide. The vulnerable endpoint allows access to data that should be restricted.

Recommendations Upgrade to version 2.0.0 to resolve the issue for Apache Answer versions through 1.7.1. Upgrade to version 2.0.0 to resolve the issue for github.com/apache/answer versions prior to 2.0.0.

Fix

Weakness Enumeration

CWE-359

Related Identifiers

CVE-2026-24735

GHSA-5W5R-8XC6-2XHW

GO-2026-4421

SUSE-SU-2026:0403-1

Affected Products

Apache Answer

References · 93

• https://osv.dev/vulnerability/CVE-2026-24735 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24735 · Security Note
• https://osv.dev/vulnerability/GHSA-5w5r-8xc6-2xhw · Vendor Advisory
• https://lists.apache.org/thread/whxloom7mpxlyt5wzdskflsg5mzdzd60 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4421 · Vendor Advisory
• https://github.com/apache/answer · Note
• https://suse.com/security/cve/CVE-2026-23851 · Note
• https://suse.com/security/cve/CVE-2026-23829 · Note
• https://twitter.com/cracbot/status/2020814991407096257 · Twitter Post
• http://openwall.com/lists/oss-security/2026/02/04/1 · Note
• https://suse.com/support/update/announcement/2026/suse-su-20260403-1 · Note
• https://suse.com/security/cve/CVE-2026-25160 · Note
• https://suse.com/security/cve/CVE-2026-23518 · Note
• https://suse.com/security/cve/CVE-2026-25579 · Note