CVE-2026-79620: Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata
Exposure of sensitive information through data queries vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Apache Answerto a version that resolves this vulnerability.Fixed in 2.0.3
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated to Apache Answer. The affected authorization check is in similar-question search, so exposure occurs through that feature.
What information could be disclosed?
Authenticated users may be able to view metadata associated with non-public questions. The provided information does not specify which metadata fields are exposed.
Which versions are affected and what is the fix?
Apache Answer through version 2.0.2 is affected. Upgrade to version 2.0.3, which fixes the authorization issue.