EUVD-2026-104161
GHSA-q46v-29x8-h5mj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Apache Answer instance
-
ExploitInvoke similar-question search
-
ExecutionTrigger improper authorization check
-
ImpactDisclose non-public question metadata
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V14 - Data Protection Sensitive data in outbound message
|
| Exploitation Conditions | Exploitation requires an authenticated account on the target Apache Answer instance (version 2.0.2 or earlier) and access to the similar-question search feature, which performs an improper authorization check. The limiting factors are significant: the attacker must first have valid credentials/a session (no anonymous access per the advisory text), the deployment must be running a vulnerable version, and the disclosure is confined to metadata of non-public questions rather than full question content or other sensitive data. There is no indication the flaw depends on a non-default configuration - it appears present in the standard similar-question search behavior. |
| Impact | This is a moderate-severity information-disclosure issue, not a high-priority emergency. The vendor (Apache) rates it 'moderate,' and no CVSS vector, EPSS score, KEV listing, or public POC is present in the supplied data, so there is no signal of active or probable exploitation. The impact is narrow: improper authorization in the similar-question search feature leaks only METADATA of non-public questions, not full content, credentials, or system control - a confidentiality-only weakness with no integrity or availability impact. The description explicitly scopes the actor to 'authenticated users,' which raises the bar beyond anonymous internet attackers, though note NO CVSS vector was provided to independently confirm the privilege requirement (authentication is stated in prose only, per precision rules it is not vendor-vector-confirmed). No conflicting signals exist, but several key quantitative signals (CVSS, EPSS, SSVC) are simply MISSING. Overall this is a low-real-risk, defense-in-depth fix rather than a drop-everything priority: patch on a normal cycle to version 2.0.3. |
| Exploit ScenarioDerived | An attacker who already holds a valid (even low-privilege) account on an Apache Answer instance uses the built-in similar-question search feature, which fails to enforce authorization against non-public questions. By submitting crafted search queries, they retrieve metadata about private or restricted questions they should not be able to see. No public exploit code is identified at the time of analysis, and the attack requires a working authenticated session. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Improper authorization in the similar-question search of Apache Answer through 2.0.2 allows an authenticated user to retrieve metadata belonging to non-public questions they are not entitled to see. The issue is remotely reachable, low complexity, and requires only a valid account plus use of the similar-question search feature, matching the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, so impact is confined to information disclosure of question metadata with no effect on integrity or availability. No public exploit code has been identified at time of analysis and there is no confirmation of active exploitation (not in CISA KEV); the vendor-stated fix is Apache Answer 2.0.3.
RemediationAI
Upgrade Apache Answer to version 2.0.3, which the vendor states fixes the improper authorization check in the similar-question search; this is the vendor-released patch and the only complete remediation, with no backport version identified for the 2.0.2 line in the supplied data (see the oss-security advisory at https://seclists.org/oss-sec/2026/q4/205 and the project site at https://answer.apache.org). If immediate upgrade is not possible, apply compensating controls with awareness of their trade-offs: disable or hide the similar-question search component where the interface allows it, accepting that users lose related-question discovery; restrict account creation and audit existing accounts so that only vetted, trusted users hold credentials, since the flaw requires an authenticated session (this reduces the pool of potential abusers but does not remove the exposure for legitimate low-privilege users); and constrain network access to the Answer instance via reverse-proxy authentication or IP allow-listing, which limits reachability but adds operational friction for legitimate remote users and does not address insider risk. Monitor application logs for unusual similar-question search requests originating from low-privilege accounts as a detective measure, understanding this provides no preventative protection.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Answer is an open-source question-and-answer platform used for community forums, help centers, and internal knowledge management, where questions can carry visibility states (public vs. non-public/draft/private). The similar-question search feature issues data queries against the question store to surface related content; in versions through 2.0.2 that query path lacked a proper authorization check scoping results to questions the requesting user is permitted to view, so rows describing non-public questions were returned to any authenticated caller. The advisory characterizes this as an exposure of sensitive information through data queries, and the underlying root-cause class is improper authorization / missing access-control enforcement on a query endpoint (the supplied data does not assign a CWE, but it maps to the incorrect-authorization family such as CWE-863; no CPE strings were provided to further narrow the affected build). Because the CVSS vector carries PR:L, authentication is required - anonymous visitors cannot exercise the flaw - and the disclosure is limited to the metadata of non-public questions, not their full body content. The flaw appears to be present in default similar-question search behavior rather than requiring a non-default configuration.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Web-based feature reachable over the network (AV:N) with no special complexity (AC:L); the advisory states authenticated users, so PR:L; only limited metadata is leaked, so C:L and I/A:N.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Description PRE-NVD
Threat Intelligence Overview
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB