CVE-2026-76994: Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles
Unauthenticated users can pull hidden-question metadata from Apache Answer public profiles.
CVE-2026-76994 is a moderate exposure-of-sensitive-information flaw in Apache Answer through 2.0.2. Unauthenticated attackers can obtain metadata associated with hidden questions through public answer profiles. Apache recommends upgrading to 2.0.3. The disclosure, credited to sec-reex, does not say the issue is being exploited.
- Unauthenticated attackers can read metadata of hidden questions.
- Affects Apache Answer through 2.0.2; upgrade to 2.0.3.
- Rated moderate; credited to sec-reex; no exploitation stated.
- CVEs
- CVE-2026-76994
- Vendors
- Apache
- Products
- Apache Answer
- Organizations
- Apache Software Foundation
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-76994 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer | — | — |
From the original article
Posted by Enxin Xie on Oct 15 Severity: moderate Affected versions: - Apache Answer through 2. 0. 2 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.