CVE-2026-34905: Apache Answer Unlisted Question Information Disclosure Vulnerability

Technical summary

CVE-2026-34905 is an information disclosure vulnerability in Apache Answer stemming from inadequate authorization checks on API endpoints that handle unlisted questions. While the web interface may respect access restrictions, the underlying API does not properly validate whether a logged-in user has permission to retrieve unlisted question content. An authenticated attacker can directly query these endpoints to enumerate and access restricted content, including associated answers, comments, and historical revisions. The vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) and carries a CVSS v3.1 score of 6.5 (Medium severity) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no integrity or availability risk.

Business impact

For organizations operating private or semi-private knowledge bases, Q&A platforms, or documentation systems on Apache Answer, this vulnerability poses a risk of unintended information leakage. Content that was deliberately marked unlisted—potentially containing draft discussions, sensitive internal questions, or restricted knowledge—becomes accessible to any user with a login. Depending on deployment context, this could expose competitive strategy discussions, internal troubleshooting, security-adjacent inquiries, or other confidential content to broader sets of internal or partner users than intended.

Affected systems

Apache Answer versions through 2.0.0 are affected. Organizations running version 2.0.0 or earlier should assume they are vulnerable. The fix is available in version 2.0.1 and later.

Exploitability

Exploitation requires authentication—the attacker must possess valid login credentials. Once authenticated, the attack requires no user interaction, no special network positioning, and trivial technical effort: direct API calls to retrieve unlisted question IDs and their metadata. The barrier to exploitation is low because API endpoints are network-accessible and do not require privilege escalation or complex payloads. This makes the vulnerability practically exploitable by any internal user or account-holder with basic familiarity of REST APIs.

Remediation

Upgrade Apache Answer to version 2.0.1 or later. This version enforces proper authorization checks on the API endpoints that serve unlisted question content. Organizations should prioritize this patch for environments where unlisted questions are used to protect sensitive or restricted information.

Patch guidance

Verify and apply Apache Answer version 2.0.1 or later from the official Apache Answer release channels. Review your deployment's version number before patching to ensure you are moving from a vulnerable version. Test the patch in a non-production environment first to confirm API behavior and any integration points remain functional. After patching, verify that unlisted questions are no longer accessible to unauthorized users by testing with a non-admin account.

Detection guidance

Monitor API access logs for requests to question endpoints (particularly GET or read operations) made by users who should not have access to unlisted content. Look for patterns such as enumeration of question IDs, repeated API calls to /api/question or similar paths, or access to questions marked as unlisted. If available, inspect API gateway or application firewall logs for anomalous authentication patterns. Conduct a manual audit of unlisted questions in production systems running version 2.0.0 or earlier to determine if any have been accessed by unauthorized accounts (if audit trails are available). Also review user access logs to identify which users have interacted with APIs and cross-reference with question permissions.

Why prioritize this

Although the CVSS score is Medium (6.5), this vulnerability should be prioritized because it directly compromises the confidentiality of content explicitly marked as private or restricted. The ease of exploitation (no user interaction required, authenticated access only) combined with the intentional use case of unlisted questions makes this a practical information leakage risk. Organizations relying on unlisted content for sensitive discussions should treat this as higher urgency.

Risk score, explained

The CVSS v3.1 score of 6.5 reflects high confidentiality impact (C:H) balanced against the requirement for prior authentication (PR:L) and the absence of integrity or availability impacts. The score appropriately captures a scenario where sensitive information is exposed but the system continues to function and no data modification occurs. However, context matters: if unlisted questions are used to store compliance, security, or business-critical information, the risk profile is elevated beyond the numeric score.

Frequently asked questions