Information disclosure in Apache Answer - CVE-2026-76994
Published: October 22, 2026
Vulnerability identifier: #VU157273
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76994
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to obtain metadata associated with hidden questions.
The vulnerability exists due to insufficient restriction of sensitive information in Apache Answer's public answer profiles when displaying metadata associated with hidden questions. A remote attacker can access these public profiles to obtain hidden-question metadata without authorization.
Affected software
Apache Answer
How to mitigate CVE-2026-76994
Install security update from vendor's website.
Apache Answer - update to 2.0.3