GitHub Advisoryadvisory · Go

GHSA-w754-5646-xq9j Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability

MEDIUM Published 2026-06-09 Modified 2026-07-30 Official page ↗
Aliases
CVE-2026-25699
Ecosystem
Go
Packages
github.com/apache/incubator-answer
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-359
Reviewed
2026-07-30

Affected packages

• Go github.com/apache/incubator-answer: < 1.7.2-0.20260206073245-92994b49976b → fixed in 1.7.2-0.20260206073245-92994b49976b

Description

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Timeline-related APIs lacked proper authorization checks, allowing regular authenticated users to access deleted, private, or unapproved content and its revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Related

Alias · CVE (1)

  • CVE-2026-25699 Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. vulnerability

Weakness · CWE (1)

  • CWE-359 Exposure of Private Personal Information to an Unauthorized Actor weakness

References