CVE-2026-60023: Apache Answer: Unauthorized disclosure of deleted or pending answer content
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.1.
Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing answer content that should not have been accessible. Users are recommended to upgrade to version 2.0.2, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.2Patch CVE-2026-60023
Event History
Frequently Asked Questions
What is the severity of CVE-2026-60023?
CVE-2026-60023 has a risk score of 33, indicating a moderate level of severity.
How do I fix CVE-2026-60023?
To mitigate CVE-2026-60023, ensure that access controls are properly enforced to prevent unauthorized access to deleted or pending answers.
What type of information is exposed by CVE-2026-60023?
CVE-2026-60023 allows unauthorized actors to access deleted or pending content of answers associated with visible parent questions.
Which versions of Apache Answer are affected by CVE-2026-60023?
CVE-2026-60023 affects Apache Answer versions up to 2.0.1.
What is the impact of CVE-2026-60023 on users?
Users may unintentionally expose sensitive information through deleted or pending answers that can be accessed by unauthorized individuals.