Answer
CVE-2026-24735
HIGH
GHSA-5w5r-8xc6-2xhw
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.7.1.
An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.
AnalysisAI
Answer contains a vulnerability that allows attackers to retrieve restricted or sensitive information (CVSS 7.5).
Technical ContextAI
exists in the 1.7.1.
An unauthenticated API component. Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.
This issue affects Apache Answer: through 1.7.1.
An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.
RemediationAI
Update to version 2.0.0 or later. Restrict network access to the affected service where possible.
Authentication Bypass by Capture-replay in GitHub repository answerdev/answer prior to 1.0.6. Rated critical severity (C
Improper Access Control in GitHub repository answerdev/answer prior to 1.0.4. Rated critical severity (CVSS 9.8), this v
Cross-site Scripting (XSS) - Generic in GitHub repository answerdev/answer prior to 1.0.4. Rated critical severity (CVSS
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4. Rated critical severity (CVSS
Cross-site Scripting (XSS) - DOM in GitHub repository answerdev/answer prior to 1.0.4. Rated critical severity (CVSS 9.0
Cross-site Scripting (XSS) - Stored in GitHub repository answerdev/answer prior to 1.0.4. Rated critical severity (CVSS
Missing Authentication for Critical Function in GitHub repository answerdev/answer prior to v1.1.3. Rated high severity
Insufficient Session Expiration in GitHub repository answerdev/answer prior to v1.1.0. Rated high severity (CVSS 8.8), t
Weak Password Requirements in GitHub repository answerdev/answer prior to v1.1.0. Rated high severity (CVSS 8.8), this v
Password Aging with Long Expiration in GitHub repository answerdev/answer prior to 1.0.6. Rated high severity (CVSS 8.8)
Insufficient Session Expiration in GitHub repository answerdev/answer prior to 1.0.6. Rated high severity (CVSS 8.8), th
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') in GitHub repository answerd
Vendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 15.6 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Fixed |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Fixed |
| openSUSE Leap 15.5 | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today