PT-2026-6373 · Go · Github.Com/Apache/Answer

Published 2026-02-04 · Updated 2026-02-04

OSV

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.7.1.

An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized users to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.

Fix

Weakness Enumeration

CWE-359

Related Identifiers

GHSA-5W5R-8XC6-2XHW

Affected Products

Github.Com/Apache/Answer

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-24735 · Security Note
• https://osv.dev/vulnerability/GHSA-5w5r-8xc6-2xhw · Vendor Advisory
• https://github.com/apache/answer · Note
• https://lists.apache.org/thread/whxloom7mpxlyt5wzdskflsg5mzdzd60 · Note
• http://openwall.com/lists/oss-security/2026/02/04/1 · Note