CVE-2026-24735

CVE-2026-24735: Apache Answer: Revision API Improper Access Control leads to Information Disclosure

Vendor Apache Software Foundation
Product Apache Answer
Weakness CWE-359
Published February 4, 2026
Last update February 4, 2026

CVSS base score

What the vulnerability does

Description

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.

Key dates

Disclosure timeline

February 4, 2026 CVE published
February 4, 2026 Record updated