CVE-2026-60023

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.1. Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing answer content that should not have been accessible. Users are recommended to upgrade to version 2.0.2, which fixes the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://lists.apache.org/thread/rq3ygd0j9cchkbmh99dqf8624s7r8y49	Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/08/05/13	Mailing List Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Vulnerabilidad de Exposición de Información Sensible a un Actor No Autorizado en Apache Answer. Este problema afecta a Apache Answer: hasta la versión 2.0.1. Respuestas eliminadas o pendientes podrían ser recuperadas por usuarios no autorizados a través de la ruta de lectura de respuesta única cuando la pregunta principal permanecía visible, exponiendo contenido de respuesta que no debería haber sido accesible. Se recomienda a los usuarios actualizar a la versión 2.0.2, que corrige el problema.

Information

Published : 2026-08-05 16:16

Updated : 2026-10-24 16:10

NVD link : CVE-2026-60023

Mitre link : CVE-2026-60023

CVE.ORG link : CVE-2026-60023

JSON object : View

Products Affected

apache

answer

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2026-60023", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-60023", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T14:38:20.651376Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@apache.org", "affectedData": [{"vendor": "Apache Software Foundation", "product": "Apache Answer", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.0.1"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-05T16:16:58.203", "references": [{"url": "https://lists.apache.org/thread/rq3ygd0j9cchkbmh99dqf8624s7r8y49", "tags": ["Mailing List", "Vendor Advisory"], "source": "security@apache.org"}, {"url": "http://www.openwall.com/lists/oss-security/2026/08/05/13", "tags": ["Mailing List", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@apache.org", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.\n\nThis issue affects Apache Answer: through 2.0.1.\n\nDeleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing answer content that should not have been accessible.\nUsers are recommended to upgrade to version 2.0.2, which fixes the issue."}, {"lang": "es", "value": "Vulnerabilidad de Exposici\u00f3n de Informaci\u00f3n Sensible a un Actor No Autorizado en Apache Answer.\n\nEste problema afecta a Apache Answer: hasta la versi\u00f3n 2.0.1.\n\nRespuestas eliminadas o pendientes podr\u00edan ser recuperadas por usuarios no autorizados a trav\u00e9s de la ruta de lectura de respuesta \u00fanica cuando la pregunta principal permanec\u00eda visible, exponiendo contenido de respuesta que no deber\u00eda haber sido accesible.\nSe recomienda a los usuarios actualizar a la versi\u00f3n 2.0.2, que corrige el problema."}], "lastModified": "2026-10-24T16:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5584F84D-4A07-42B6-8380-4DBD2C81D87B", "versionEndExcluding": "2.0.2"}], "operator": "OR"}]}], "sourceIdentifier": "security@apache.org"}