Apache Answer: Revision API Improper Access Control leads to Information Disclosure

Vulnerability

Description

CVE-2026-24735 is an exposure of private personal information vulnerability in Apache Answer, a Q&A platform software. The issue resides in an unauthenticated API endpoint that incorrectly exposes the full revision history of deleted content. This design flaw allows any unauthorized user to retrieve restricted or sensitive information that was meant to be removed or hidden. The vulnerability affects all versions of Apache Answer up to and including version 1.7.1 [1][2].

Attack

Vector

The vulnerability can be triggered by an unauthenticated attacker sending requests to the affected API endpoint. No authentication or prior access is required. The endpoint fails to properly enforce access controls for deleted content revision history, meaning that even after a user deletes content, the complete revision history—potentially containing private personal information, proprietary data, or other sensitive details—remains accessible [2]. The attack surface is broad since the API is publicly reachable in default deployments.

Impact

Successful exploitation enables an attacker to read the full revision history of deleted content, which may include personal data, credentials, intellectual property, or other confidential information that users or administrators intended to permanently remove. This is a direct violation of user privacy and data retention policies. The information disclosed could be used for further attacks, identity theft, or corporate espionage [1][2].

Mitigation

The Apache Answer development team has addressed the issue in version 2.0.0, released on 2026-02-04. Users are strongly recommended to upgrade to this version immediately. No workarounds have been published. The vulnerability was discovered and reported by Sho Odagiri of GMO Cybersecurity by Ierae, Inc. [2]. At the time of publication, Apache Answer version 2.0.0 is available from the project's GitHub repository [3] and official website.