Apache Answer CVE-2026-60023

The parent question must remain in a publicly visible state - if the question is also deleted or access-restricted, the API path is blocked before reaching the answer-level check. The attacker must know or enumerate a valid answer ID associated with a deleted or pending answer; ID enumeration is the primary practical barrier. No authentication is required (CVSS PR:N confirmed). Exploitation is strictly read-only and limited to answer content withheld by moderation (deleted or pending state); it does not expose credentials, other users' private data, or system internals. Deployments where all content requires authentication, or where the answer read API is not reachable from untrusted networks, are not meaningfully exposed.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N yields a 7.5 base score - network-reachable, zero-complexity, unauthenticated exploitation with rated-high confidentiality impact. However, EPSS at 0.17% (7th percentile) and the absence of a KEV listing or known POC together indicate very low observed exploitation interest. The true confidentiality impact is bounded: only deleted or pending answer content is exposed, not credentials, session tokens, or system internals. This is a case where CVSS numerically overstates operational risk - the data class is application content, not authentication material. Priority should scale with how sensitive the deleted/pending answer content is in a given deployment (e.g., a platform hosting legally sensitive draft content carries higher real-world risk than a low-sensitivity public forum). No conflicting signals exist between CVSS and description; both consistently indicate a remote, unauthenticated, read-only disclosure.

An unauthenticated attacker identifies a public Apache Answer deployment and iterates over numeric or predictable answer IDs via direct HTTP GET requests to the single-answer read endpoint. Because the endpoint checks only whether the parent question is public - not whether the answer itself is deleted or pending - the server returns the full content of moderation-withheld answers. No public exploit code has been identified at time of analysis.