What is the CVSS score of CVE-2026-25699?

CVE-2026-25699 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Apache Answer are affected by CVE-2026-25699?

Apache Answer platforms contain a critical authorization flaw that allows any authenticated user to access sensitive, private, and deleted content-exposing organizational knowledge bases and…. A patch is available.

How to fix or mitigate CVE-2026-25699?

24 hours: Inventory all Apache Answer instances and current versions; disable user self-registration if operationally feasible; search access logs for Timeline API requests from non-administrative accounts. 7 days: Restrict Timeline API endpoints to administrators only via network controls, WAF rules, or application configuration; establish continuous monitoring for anomalous API access patterns. 30 days: Monitor Apache Answer security advisories for patch release and test thoroughly; prepare upgrade plan to latest patched version; if patch delayed beyond 60 days, evaluate temporary isolation or migration to alternative platform.

Apache Answer CVE-2026-25699

EUVD-2026-35368 MEDIUM

Exposure of Private Personal Information to an Unauthorized Actor (CWE-359)

2026-06-09

GHSA-w754-5646-xq9j

Authentication Bypass Apache Answer

6.1

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Jun 09, 2026 - 16:22 NVD

6.1 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 08:16 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

Articles & Coverage 1

News Critical Information Disclosure in Apache Answer 2.0.0 - CVE-2026-25699 Jun 09, 2026

AnalysisAI

Apache Answer's Timeline API endpoints through version 2.0.0 fail to enforce authorization, exposing deleted, private, and unapproved content - along with full revision histories - to any authenticated regular user. The vulnerability is an information disclosure flaw affecting all Apache Answer deployments (community forums, help centers, knowledge platforms) running 2.0.0 or earlier. No public exploit has been identified and no KEV listing exists; however, in community deployments where user accounts are freely self-registered, the authentication prerequisite provides limited real-world protection.

Technical ContextAI

Apache Answer is an open-source Q&A platform (approximately 15,500 GitHub stars) designed for team knowledge management and community forums. The platform enforces content lifecycle states - deleted, private, and unapproved - as access control boundaries visible only to moderators or administrators. The Timeline API subsystem exposes revision history and content state transitions for posts and questions. The root cause aligns with CWE-862 (Missing Authorization): the timeline-related API endpoints returned full content objects and their revision history without validating whether the requesting user's role or permissions granted access to the requested content's visibility state. No CPE string was provided in the available data, but the vulnerability is present across all versions through 2.0.0 regardless of deployment configuration.

RemediationAI

Upgrade to Apache Answer version 2.0.1, which is confirmed by the vendor's oss-security advisory as the definitive fix for the missing authorization checks in the Timeline API. Refer to https://answer.apache.org and the advisory at https://seclists.org/oss-sec/2026/q2/852 for upgrade instructions. If an immediate upgrade cannot be performed, consider restricting access to the timeline API endpoints at the reverse proxy or WAF layer to moderator and administrator roles only - accepting the trade-off that regular users will lose timeline browsing functionality. A secondary compensating control is to disable open self-registration to require administrator approval for new accounts, which increases friction for opportunistic exploitation in community deployments. Neither workaround addresses the root authorization flaw; upgrading to 2.0.1 is the only confirmed remediation.