CVE-2026-34905
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk25th percentile - higher than 25% of all known CVEs
Summary
Apache Answer up to version 2.0.0 did not enforce access restrictions on direct API endpoints for unlisted questions. Authenticated users could discover and view such questions, answers, comments, and revision history.
Risk Assessment
Exposure of unlisted content can lead to leakage of confidential information and violation of user privacy.
Recommendation
Upgrade Apache Answer to version 2.0.1, which fixes this vulnerability.
Other vulnerabilities in Apache Answer
See all- CVE-2026-60053Critical
Apache Answer through version 2.0.1 has insufficient session expiration: administrative API keys remain usable after the owning administrator is demoted or the account is marked inactive, suspended, or deleted, allowing continued access until the keys are explicitly removed.
- CVE-2026-60023High
Apache Answer through version 2.0.1 has a vulnerability exposing sensitive information: deleted or pending answers can be retrieved by unauthorized users through the single-answer read path when the parent question remains visible.
- CVE-2026-50749Medium
Apache Answer through version 2.0.1 has an improper authorization vulnerability: any authenticated user can reject arbitrary pending edit-revisions without review permission due to a missing authorization check on the reject operation.
- CVE-2026-48912Medium
Apache Answer through version 2.0.1 has an improper input validation vulnerability: a missing ownership check in the avatar-cleanup logic allows any authenticated user to delete other users' uploaded files by supplying their file URLs.
- CVE-2026-48911High
Apache Answer through version 2.0.1 has an insufficient verification of data authenticity vulnerability: a missing authorization check in the external-login email binding flow allows unauthenticated attackers to take over arbitrary user accounts by tricking victims into clicking a crafted confirmation link.
- CVE-2026-48834High
Apache Answer through version 2.0.1 has an improper handling of length parameter inconsistency vulnerability: unauthenticated attackers can cause a denial of service via a specially crafted Accept-Language header that triggers excessive CPU consumption during parsing.
- CVE-2026-25700High
CVE-2026-25700 describes an improper restriction of security token assignment vulnerability in Apache Answer up to version 2.0.0. Previously issued administrative tokens were not invalidated after an administrator account was suspended, deleted, or deactivated, allowing continued access to administrative APIs until the token expired.
- CVE-2026-34033Medium
Apache Answer through version 2.0.0 has an XSS vulnerability because user-supplied content is included in notification emails without proper escaping. An authenticated user can inject arbitrary HTML into emails sent to other users.
- CVE-2026-34031Medium
In Apache Answer up to version 2.0.0, there is an unrestricted file upload vulnerability with dangerous type. The server did not sufficiently validate user-supplied image URLs, allowing arbitrary external content to be embedded as profile images.
- CVE-2026-33582Medium
Apache Answer up to version 2.0.0 has an unrestricted file upload vulnerability. A crafted TIFF image can trigger excessive memory allocation during decoding, causing a server crash. Authentication is required.
Original NVD description (English source)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The unlisted question feature did not enforce access restrictions on direct API endpoints, allowing authenticated users to discover and access unlisted questions, their answers, comments, and revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.