CVE-2026-25699 — Apache Answer: Authorization Bypass in Timeline API

Description (CNA)

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Timeline-related APIs lacked proper authorization checks, allowing regular authenticated users to access deleted, private, or unapproved content and its revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Affected (CNA)

Vendor / product	Versions
Apache Software Foundation / Apache Answer	affected 0 through 2.0.0

CWE

CWE-359

References

https://lists.apache.org/thread/c36k4hzwhncqo0qfn5fg57f1gkjhyfv8

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2026/06/09/6

CISA-ADP

No English description supplied.

No references supplied.