Apache Answer 2.0.2 Unauthenticated Comment Disclosure via Public User Profiles
CVE-2026-79613 Published on October 19, 2026
Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles
vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
Unauthenticated attackers could access comments associated with non-public content through public user profiles.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.
Weakness Type
Exposure of Sensitive Information Through Data Queries
When trying to keep information confidential, an attacker can often infer some of the information by using statistics. In situations where data should not be tied to individual users, but a large number of users should be able to make queries that "scrub" the identity of users, it may be possible to get information about a user -- e.g., by specifying search terms that are known to be unique to that user.
Products Associated with CVE-2026-79613
Want to know whenever a new CVE is published for Apache Answer? stack.watch will email you.
Affected Versions
Apache Software Foundation Apache Answer:- Before and including 2.0.2 is affected.