GitHub Advisoryadvisory · Go

GHSA-5w5r-8xc6-2xhw Apache Answer Exposure of Private Personal Information to an Unauthorized Actor vulnerability

MEDIUM Published 2026-02-04 Modified 2026-02-04 Official page ↗
Aliases
CVE-2026-24735
Ecosystem
Go
Packages
github.com/apache/answer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-359
Reviewed
2026-02-04

Affected packages

• Go github.com/apache/answer: < 2.0.0 → fixed in 2.0.0

Description

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized users to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-24735 Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. vulnerability

Weakness · CWE (1)

  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor weakness

References