CVE-2026-24735 — Apache Answer: Revision API Improper Access Control leads to Information Disclosure

Description (CNA)

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Answer	affected 0 through 1.7.1

CWE

CWE-359

References

https://lists.apache.org/thread/whxloom7mpxlyt5wzdskflsg5mzdzd60

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/02/04/1