CVE-2026-60023

CVE-2026-60023: Apache Answer: Unauthorized disclosure of deleted or pending answer content

Vendor Apache Software Foundation

Product Apache Answer

Weakness CWE-200 · Info exposure

Published August 5, 2026

Last update August 5, 2026

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing answer content that should not have been accessible. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

Key dates

02Disclosure timeline

August 5, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-60023 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/200.html AskarLabs — CWE-200 write-up Exposure of Sensitive Information to an Unauthorized Actor

Related vulnerabilities

04Related CVE

CVE-2026-60031 Joomla Extension - themexpert.com - Information disclosure in Quix Page Builder < 6.2.1 CVE-2026-10865 Cost Calculator Builder <= 4.0.11 - Unauthenticated Sensitive Information Exposure of Payment Gateway Secret Keys CVE-2026-2571 Download Manager <= 3.3.49 - Missing Authorization to Authenticated (Subscriber+) User Email Enumeration via 'user' Parameter CVE-2026-3504 Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 4.3.1 - Unauthenticated Information Disclosure in Store Reviews REST API Endpoint CVE-2026-0950 Spectra Gutenberg Blocks <= 2.19.17 - Unauthenticated Information Disclosure in Sensitive Data