EUVD-2026-104159
GHSA-j4f7-j6xw-2g4m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach public answer profile endpoint
-
ExploitEnumerate/request profile data
-
ImpactExtract leaked hidden-question metadata
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an Apache Answer instance (version through 2.0.2) with publicly accessible answer-profile pages - the default public-facing Q&A/community deployment mode this software is built for. The leaked data is limited to metadata of hidden questions, not their full content, which caps the practical sensitivity of the exposure. Limiting factors: the instance must be network-reachable to the attacker, must be running a vulnerable version (2.0.2 or earlier), and the value of the disclosure depends on whether the deployment actually uses hidden questions whose existence is sensitive. No authentication or user interaction is described as required. |
| Impact | This is a low-to-moderate priority issue despite being network-reachable and unauthenticated. The vendor (Apache) rates it 'moderate,' and no CVSS vector, EPSS score, KEV listing, or public POC is provided in the input, so there is no signal of active or probable exploitation - exploitation status is 'no public exploit identified at time of analysis.' The impact is narrowly scoped: disclosure of metadata associated with hidden questions via public answer profiles, i.e. a confidentiality-only information-exposure flaw (CWE-200 class) with no integrity or availability consequence and no code execution. Because no CVSS vector was supplied by NVD or the vendor, authentication and vector characteristics are inferred from the advisory text rather than confirmed; the description's explicit 'Unauthenticated attackers' wording aligns with a network, no-auth exposure, but this should be treated as inferred, not vendor-confirmed via CVSS. Overall: a real but limited data-leak bug worth patching on a normal cycle, not an emergency - the absence of EPSS/KEV/POC combined with the metadata-only impact argues against widespread opportunistic exploitation. |
| Exploit ScenarioDerived | An unauthenticated attacker browses or queries the public answer-profile endpoints of an internet-facing Apache Answer instance and harvests metadata tied to questions that were intended to be hidden, learning of their existence and attributes without any account. No public exploit code is identified; the attack requires only normal HTTP access to the exposed profile feature. Attack complexity appears low given no authentication or special interaction is described. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 16, 2026
Apache Answer through 2.0.2 leaks metadata belonging to hidden questions to unauthenticated visitors through publicly reachable answer-profile pages, letting anyone who can reach the instance learn about hidden questions and read metadata that was never meant to be public. The disclosure is metadata only, not the full hidden-question content, so real-world sensitivity depends on whether the deployment treats the existence of hidden questions as confidential; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. The assessed severity is low-to-moderate (CVSS 3.1 5.3, AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N), with the vendor-released fix in Apache Answer 2.0.3.
RemediationAI
Upgrade to Apache Answer 2.0.3, which the vendor advisory identifies as the release that fixes the hidden-question metadata exposure; this is the only complete remediation and requires a service restart, so schedule it for a maintenance window on public-facing instances. If immediate upgrade is not possible, the most effective compensating control is to stop exposing answer-profile pages to anonymous users - place the profile endpoints behind authentication or block them at the reverse proxy/WAF with a rule that returns 403 to unauthenticated requests for these paths - accepting the trade-off that anonymous visitors lose the ability to browse user contribution history and the community-discovery aspect of the site degrades. As a secondary measure, avoid using the hidden-question feature to protect genuinely sensitive material (for example internal ticket references or customer identifiers) until the upgrade is applied, since hidden status is evidently not enforced as an access-control boundary in version 2.0.2, and treat any such metadata as already potentially disclosed when assessing downstream exposure. Refer to https://answer.apache.org and https://seclists.org/oss-sec/2026/q4/203 for vendor guidance, and note that no patch other than the 2.0.3 release line is documented in the available data.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Apache Answer is an Apache Software Foundation open-source Q&A and community platform used as an internet-facing forum, help center, or knowledge base (the project site highlights tagging, search, plugins, and gamification features, with roughly 15.7k stars). The defect is an access-control/authorization gap rather than a memory-safety or injection bug: the public answer-profile view, which renders a user's contributions, fails to filter out metadata attached to questions flagged as hidden, so a routine profile request returns fields the caller is not entitled to observe. The CVE description classifies the weakness as "Exposure of Sensitive Information to an Unauthorized Actor," which corresponds to the CWE-200 exposure class, although no CWE identifier was formally assigned in the record. Because only metadata is exposed and not question bodies, the confidentiality impact is rated Low, with integrity and availability unaffected; the assessed vector requires no privileges and no user interaction (PR:N, UI:N), consistent with the description stating that unauthenticated attackers can trigger it on any network-reachable instance. No CPE strings were supplied in the source data, so affected scope is defined by the version statement (through 2.0.2) rather than by CPE matching.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Advisory states unauthenticated remote access via public profiles (AV:N/PR:N/UI:N); only limited hidden-question metadata leaks, so C:L and I:N/A:N.
Estimated by vuln.today — no official severity rating has been published for this CVE yet.
Description PRE-NVD
Threat Intelligence Overview
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB