GHSA-w754-5646-xq9j

Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-25699

Packages

Ecosystem	Package	Affected	Fixed in
Go	github.com/apache/incubator-answer	< 1.7.2-0.20260206073245-92994b49976b	1.7.2-0.20260206073245-92994b49976b

Details

As written in the advisory (Markdown source, shown as plain text).

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Timeline-related APIs lacked proper authorization checks, allowing regular authenticated users to access deleted, private, or unapproved content and its revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-25699 advisory
https://github.com/apache/answer/commit/92994b49976b6206a7000d045d924ec4fd5be1be web
https://github.com/apache/answer package
https://github.com/apache/answer/releases/tag/v2.0.1 web
https://lists.apache.org/thread/c36k4hzwhncqo0qfn5fg57f1gkjhyfv8 web
http://www.openwall.com/lists/oss-security/2026/06/09/6 web