Apache Answer EUVD-2026-104157

Exploitation requires that the target Apache Answer instance (version through 2.0.2) contains non-public questions that have an associated invited-user list, and that the attacker can reach and invoke the invited-user lookup functionality for such a question - likely needing a valid or guessable question identifier. The advisory states an unauthenticated or unauthorized user can succeed, implying no special configuration is needed beyond the default presence of the invite feature; however, this is not confirmed by a CVSS vector. Limiting factors: impact is confined to disclosure of the invited-user list for private questions (no modification or service impact), the instance must actually use private questions with invites, and the attacker must know or enumerate the relevant question. Upgrading to 2.0.3 removes the condition entirely.

This is a genuinely low-priority issue, consistent with the vendor's 'low' severity rating. The vulnerability is an information-disclosure flaw (missing authorization check) that exposes the invited-user list of a non-public question in Apache Answer - a limited confidentiality leak with no integrity or availability impact. No CVSS vector, EPSS score, KEV listing, SSVC decision, or POC was provided in the input, so several key prioritization signals are missing and cannot be cross-referenced. Status: no public exploit identified at time of analysis, and there is no evidence of active exploitation. The description claims an 'unauthenticated or unauthorized user' can trigger it, which would normally map to a network, no-privilege vector; however, because no CVSS vector was supplied, authentication requirements are not independently confirmed from the available data and rest solely on the advisory prose. Net assessment: a real but low-impact authorization bug worth patching during normal maintenance cycles, not an emergency - the exposed data (who was invited to a private question) is sensitive in a narrow sense but not high-value, and the affected product has a modest deployment footprint.

An attacker who is not authorized to view a private (non-public) question on an Apache Answer instance queries the invited-user lookup functionality for that question and receives back the list of invited users, revealing identities/relationships that should have been hidden. Because the advisory states an unauthenticated or unauthorized user can do this, the request likely requires only knowledge or enumeration of a target question identifier. No public exploit code has been identified at time of analysis.