CVE-2026-24735

HIGH EPSS 45.2%

Published Feb 4, 20264mo ago · Modified Jun 17, 20262w ago

7.5 CVSS 3.1

High

Published Feb 4, 2026 4mo ago

Last Modified Jun 17, 2026 2w ago

Description

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 1.7.1. An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized user to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.

CVSS Details

Base Score

7.5

Exploitability

3.9

Impact

3.6

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity None

Availability None

Threat Intelligence

EPSS Exploit Probability

45.2% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-359

Affected Products 1

Vendor	Product	Version	Range
apache	answer	*	<2.0.0

References 2

openwall.com http://www.openwall.com/lists/oss-security/2026/02/04/1

Mailing ListThird Party Advisory
lists.apache.org https://lists.apache.org/thread/whxloom7mpxlyt5wzdskflsg5mzdzd60

Mailing ListThird Party Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.