CVE-2026-25699

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-25699
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Timeline-related APIs lacked proper authorization checks, allowing regular authenticated users to access deleted, private, or unapproved content and its revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://lists.apache.org/thread/c36k4hzwhncqo0qfn5fg57f1gkjhyfv8 Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/06/09/6 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*
History

23 Jul 2026, 08:10

Type Values Removed Values Added
Summary
  • (es) Exposición de Información Personal Privada a un Actor No Autorizado vulnerabilidad en Apache Answer. Este problema afecta a Apache Answer: hasta la versión 2.0.0. Las API relacionadas con la línea de tiempo carecían de comprobaciones de autorización adecuadas, permitiendo a usuarios autenticados regulares acceder a contenido eliminado, privado o no aprobado y su historial de revisiones. Se recomienda a los usuarios actualizar a la versión 2.0.1, que soluciona el problema.

10 Jun 2026, 13:38

Type Values Removed Values Added
CPE cpe:2.3:a:apache:answer:*:*:*:*:*:*:*:*
References () https://lists.apache.org/thread/c36k4hzwhncqo0qfn5fg57f1gkjhyfv8 - () https://lists.apache.org/thread/c36k4hzwhncqo0qfn5fg57f1gkjhyfv8 - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/06/09/6 - () http://www.openwall.com/lists/oss-security/2026/06/09/6 - Mailing List, Third Party Advisory
First Time Apache
Apache answer

09 Jun 2026, 16:16

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.1

09 Jun 2026, 10:16

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/06/09/6 -

09 Jun 2026, 09:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-06-09 09:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-25699

Mitre link : CVE-2026-25699

CVE.ORG link : CVE-2026-25699

JSON object : View

Products Affected

apache

  • answer
CWE
CWE-359

Exposure of Private Personal Information to an Unauthorized Actor