CVE-2026-76994

Deferred Deferred - Pending Action

Exposure of Sensitive Information in Apache Answer

Publication date: 2026-10-19

Last updated on: 2026-11-03

Assigner: Apache Software Foundation

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. Unauthenticated attackers could obtain metadata associated with hidden questions through public answer profiles. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-19

Last Modified

2026-11-03

Generated

2026-11-08

AI Q&A

2026-10-19

EPSS Evaluated

2026-11-07

NVD

CVE-2026-76994

EUVD

EUVD-2026-104159

Affected Vendors & Products

Vendor	Product	Version / Range
Apache Software Foundation	Apache Answer	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

Executive Summary

This vulnerability in Apache Answer allows unauthenticated attackers to access metadata from hidden questions through public answer profiles. The issue affects versions up to 2.0.2 and is fixed in version 2.0.3.

Detection Guidance

This vulnerability involves unauthorized access to metadata from hidden questions via public answer profiles. To detect it, inspect Apache Answer profiles for exposed metadata and verify if hidden questions are accessible without authentication. Check for unusual access patterns or requests to profile endpoints.

Impact Analysis

Attackers could gather sensitive information about hidden questions without authentication, potentially exposing private data or internal discussions. This may lead to privacy breaches or unauthorized access to confidential content.

Compliance Impact

This vulnerability could violate data protection regulations like GDPR or HIPAA by exposing sensitive information to unauthorized parties. Organizations may face compliance penalties if user data is compromised.

Mitigation Strategies

Upgrade Apache Answer to version 2.0.3 or later to fix the vulnerability. This version addresses the exposure of sensitive metadata in hidden questions.

Hi! I’m here to help you understand CVE-2026-76994. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...