What is the CVSS score of CVE-2026-60023?

CVE-2026-60023 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of Apache Answer are affected by CVE-2026-60023?

Apache Answer versions through 2.0.1 contain an unauthenticated information disclosure vulnerability allowing unauthorized access to deleted and pending user answers that bypass moderation controls.

How to fix or mitigate CVE-2026-60023?

Within 24 hours: Identify all Apache Answer instances running version 2.0.1 or earlier and assess exposure scope. Within 7 days: Restrict the single-answer read API to authenticated users, deploy WAF rules to filter responses containing deleted or pending content, or implement IP allowlisting for the affected endpoint. Within 30 days: No vendor-released patch identified at time of analysis; monitor Apache Answer security advisories for patch availability; implement permanent compensating controls including endpoint disablement and continuous access monitoring.

Apache Answer CVE-2026-60023

EUVD-2026-53401 HIGH

Information Exposure (CWE-200)

2026-08-05 apache

GHSA-x73g-vq9w-776v

Apache Information Disclosure Apache Answer

7.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

7.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Network-reachable with no authentication or interaction required; impact is read-only disclosure of restricted content with no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Updated

Aug 06, 2026 - 15:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 06, 2026 - 15:22 vuln.today

cvss_changed

CVSS changed

Aug 06, 2026 - 15:22 NVD

7.5 (HIGH)

Analysis Generated

Aug 05, 2026 - 15:50 vuln.today

DescriptionCVE.org

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing answer content that should not have been accessible. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

AnalysisAI

Unauthenticated information disclosure in Apache Answer through 2.0.1 allows any remote user to retrieve deleted or pending answers via the single-answer read API path, provided the parent question remains publicly visible. The flaw bypasses moderation-state access controls, exposing content that was intentionally withheld from public view. No public exploit code or active exploitation has been identified; EPSS at 0.17% (7th percentile) reflects limited real-world exploitation interest despite the high CVSS score.

Technical ContextAI

Apache Answer is an open-source community Q&A platform under the Apache Software Foundation umbrella. The vulnerability stems from an incomplete access control check in the single-answer read endpoint: the server validates the parent question's visibility but fails to check the moderation state (deleted or pending) of the individual answer object being fetched. This maps to CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), a design-level authorization gap rather than a memory-safety or injection flaw. CPE string cpe:2.3:a:apache_software_foundation:apache_answer:*:*:*:*:*:*:*:* confirms all versions through 2.0.1 are affected. Because answer IDs are likely sequential or guessable, enumeration of affected answers may require minimal effort.

RemediationAI

Vendor-released patch: Apache Answer 2.0.2, which corrects the moderation-state access control check on the single-answer read path. Upgrade immediately following the vendor advisory at https://lists.apache.org/thread/rq3ygd0j9cchkbmh99dqf8624s7r8y49. If upgrade is not immediately possible, place the Apache Answer instance behind an authenticated reverse proxy to require login before any API access - note this will break unauthenticated read access for public visitors, which may be unacceptable for public-facing communities. Alternatively, network-level ACLs restricting the single-answer API route to authenticated sessions only can reduce exposure, though implementation depends on the deployment's web server configuration. Neither workaround addresses the root-cause flaw and should be treated as temporary only.