What is the CVSS score of CVE-2026-34905?

CVE-2026-34905 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34905?

Yes, a patch is available for CVE-2026-34905. Update the affected software to the latest version immediately.

Apache Answer CVE-2026-34905

EUVD-2026-35372 MEDIUM

Information Exposure (CWE-200)

2026-06-09

GHSA-85r2-pvg8-89r9

Information Disclosure Apache Answer

6.5

CVSS 3.1 · Vendor

Severity by source

Vendor (CNA) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from Vendor (CNA) · only source for this CVE.

CVSS VectorVendor

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVSS changed

Jun 09, 2026 - 16:22 NVD

6.5 (MEDIUM)

Analysis Generated

Jun 09, 2026 - 08:18 vuln.today

Description PRE-NVD

Disclosed via oss-security. NVD scoring and full description are pending.

AnalysisAI

Unauthorized information disclosure in Apache Answer through 2.0.0 allows authenticated users to bypass access restrictions on the 'unlisted question' feature by querying direct API endpoints. Rather than enforcing the same visibility controls applied at the UI layer, the underlying API routes expose unlisted questions along with their associated answers, comments, and full revision history to any authenticated user. No public exploit code has been identified and this CVE is not listed in CISA KEV, but the straightforward nature of the bypass - direct API calls - lowers the practical bar for exploitation by any platform user.

Technical ContextAI

Apache Answer is an open-source Q&A platform (github.com/apache/incubator-answer, over 15.5k GitHub stars) designed for community forums, help centers, and knowledge management. The 'unlisted' question feature is a visibility tier intended to make content accessible only to users with a direct link, not discoverable through search or listing pages - analogous to YouTube's unlisted video mode. The root cause is a server-side authorization gap: the API endpoints backing this content (question detail, answers, comments, revision history) did not independently verify whether the requesting user was permitted to view unlisted content, relying solely on UI-level gating that is trivially bypassed by crafting direct HTTP API requests. This is consistent with CWE-862 (Missing Authorization) or CWE-359 (Exposure of Private Personal Information to Unauthorized Actor), the latter being cited by the NVD entry. No CPE string or CVSS vector was supplied in the available data.

RemediationAI

Upgrade to Apache Answer version 2.0.1, which is confirmed by the Apache security advisory (https://answer.apache.org) to address this issue. The fix enforces server-side authorization checks directly on the API endpoints serving unlisted question content, closing the gap between UI-level and API-level access control. If immediate upgrade is not possible, operators should consider restricting platform registration to trusted users, as exploitation requires an authenticated account - reducing open registration or enabling invite-only mode would limit the exposed user population. Additionally, review whether any content currently marked 'unlisted' contains sensitive information that should instead be moved to a properly restricted access tier. No known side effects for upgrading to 2.0.1 are documented.