CVE-2026-25699: Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability

June 9, 2026 (updated July 30, 2026)

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

Timeline-related APIs lacked proper authorization checks, allowing regular authenticated users to access deleted, private, or unapproved content and its revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

References

github.com/advisories/GHSA-w754-5646-xq9j
github.com/apache/answer/commit/92994b49976b6206a7000d045d924ec4fd5be1be
github.com/apache/answer/releases/tag/v2.0.1
lists.apache.org/thread/c36k4hzwhncqo0qfn5fg57f1gkjhyfv8
nvd.nist.gov/vuln/detail/CVE-2026-25699

Code Behaviors & Features

Detect and mitigate CVE-2026-25699 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →