GitHub Advisoryadvisory · Go

GHSA-85r2-pvg8-89r9 Apache Answer has an Exposure of Sensitive Information to an Unauthorized Actor vulnerability

MEDIUM Published 2026-06-09 Modified 2026-07-31 Official page ↗
Aliases
CVE-2026-34905
Ecosystem
Go
Packages
github.com/apache/incubator-answer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200
Reviewed
2026-07-31

Affected packages

• Go github.com/apache/incubator-answer: < 1.7.2-0.20260509071350-11c80384f13a → fixed in 1.7.2-0.20260509071350-11c80384f13a

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The unlisted question feature did not enforce access restrictions on direct API endpoints, allowing authenticated users to discover and access unlisted questions, their answers, comments, and revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-34905 Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. vulnerability

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References