CVE-2026-60023CWE-200information-disclosure

CVE-2026-60023

High · published August 5, 2026

CVSS v3.1

7.5

EPSS

Percentile

49.1

In the wild

Unconfirmed

What it is

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.1.

Deleted or pending answers could be retrieved by unauthorized users through the single-answer read path when the parent question remained visible, exposing answer content that should not have been accessible.

Users are recommended to upgrade to version 2.0.2, which fixes the issue.

The record

Technical detail

CVSS v3.1: 7.5 · HIGH
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00622 · 49.1th percentile
Weakness: CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
Published: 2026-08-05T20:16Z

Affected products (1)

Product	Versions	Fixed in
apache/answer	< 2.0.2	2.0.2

References (2)

https://lists.apache.org/thread/rq3ygd0j9cchkbmh99dqf8624s7r8y49 · [email protected]http://www.openwall.com/lists/oss-security/2026/08/05/13 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

05 AUG 15:12Z
Apache Answer: Unauthorized disclosure of deleted or pending answer content
cvelistv5