VYPR
← All advisories
Medium severity6.1NVD Advisory· Published Jun 9, 2026· Updated Jun 10, 2026

CVE-2026-25699

CVE-2026-25699

Description

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

Timeline-related APIs lacked proper authorization checks, allowing regular authenticated users to access deleted, private, or unapproved content and its revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

2
  • Apache/Answer2 versions
    cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*range: <2.0.1
    • (no CPE)range: <=2.0.0

Patches

Vulnerability mechanics

References

2

News mentions

1