CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
Who can exploit this issue?
Unauthenticated attackers can obtain metadata associated with hidden questions through public answer profiles. No account or authenticated access is required.
Are default deployments affected?
The available information does not identify any configuration prerequisite. The affected behavior involves public answer profiles and hidden-question metadata.
What versions should be remediated?
Apache Answer versions through 2.0.2 are affected. Upgrade to version 2.0.3, which fixes the issue.