Apache Answer CVE-2026-79613

Exploitation requires a deployed Apache Answer instance (version 2.0.2 or earlier) where non-public content exists and users with activity on that content have publicly accessible profiles; the disclosure occurs via those public user profiles. No authentication is required, limiting prerequisites to network reachability of the Answer web interface. Realistic exposure is constrained to instances that actually host non-public/restricted content - a purely public Q&A deployment has little to leak. Impact is limited to disclosure of comments associated with that non-public content, not the content bodies themselves, credentials, or any write/modify capability.

This is a moderate-severity information disclosure flaw in Apache Answer (through 2.0.2) that is a genuine but bounded access-control issue rather than a top-priority emergency. No CVSS vector, EPSS score, KEV listing, or SSVC decision data was provided in the input, so quantitative exploitation-probability and automatability signals are entirely absent and cannot be compared. Based on the description alone, exploitation is unauthenticated and appears to require only normal access to public user profiles, which makes the technical barrier low; however, the impact is narrow - exposure of comments tied to non-public content, not full content, credentials, or write access. There is no public exploit identified at time of analysis and no evidence of active exploitation, so this reads as a real priority for operators of self-hosted Answer instances with private/non-public spaces, but not a widespread mass-exploitation threat. The headline 'moderate' rating is consistent with low confidentiality-only impact; defenders should patch to 2.0.3 on normal maintenance cadence rather than as an out-of-band emergency unless they host sensitive non-public communities.

An unauthenticated attacker browses a public user profile on a self-hosted Apache Answer instance and, through the profile's exposed activity, retrieves comments that were associated with non-public (restricted or private) content they should not be able to read. Because no authentication is required, the attacker needs only network access to the Answer web application. No public proof-of-concept exploit code was identified in the provided data.