CVE-2026-79620
Received Received - Intake

Sensitive Information Exposure via Search Query in Apache Answer

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: Apache Software Foundation

Description
Exposure of sensitive information through data queries vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions. Users are recommended to upgrade to version 2.0.3, which fixes the issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-79620
EUVD
EUVD-2026-104161

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Apache Software Foundation Apache Answer 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-202 When trying to keep information confidential, an attacker can often infer some of the information by using statistics.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Apache Answer allows authenticated users to access metadata of non-public questions due to an improper authorization check in the similar-question search feature. It affects versions up to 2.0.2.

Detection Guidance

To detect this vulnerability, check Apache Answer instances for version 2.0.2 or earlier. Verify if authenticated users can access metadata of non-public questions through similar-question search functionality. Upgrade to version 2.0.3 or later to mitigate the issue.

Impact Analysis

An attacker with access could view sensitive metadata of restricted questions, potentially exposing confidential information or internal discussions.

Compliance Impact

This vulnerability could potentially lead to unauthorized exposure of sensitive information, which may violate compliance requirements under regulations like GDPR or HIPAA if such data is involved. The improper authorization check allowing access to non-public question metadata could result in unauthorized data disclosure, posing risks to data protection standards.

Mitigation Strategies

Upgrade Apache Answer to version 2.0.3 or later to fix the improper authorization check in the similar-question search feature.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-79620. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart