CVE-2026-24735: Apache Answer Information Disclosure Issue

CVE-2026-24735 Overview

CVE-2026-24735 is an Exposure of Private Personal Information to an Unauthorized Actor vulnerability discovered in Apache Answer, an open-source Q&A platform. The vulnerability allows unauthenticated attackers to access the full revision history of deleted content through an improperly secured API endpoint, potentially exposing sensitive or restricted information that was intended to be removed.

Critical Impact

Unauthenticated remote attackers can retrieve sensitive information from deleted content revision history, potentially exposing private user data, confidential discussions, or other restricted content that administrators believed had been permanently removed.

Affected Products

• Apache Answer through version 1.7.1

Discovery Timeline

• February 4, 2026 - CVE-2026-24735 published to NVD
• February 4, 2026 - Last updated in NVD database

Technical Details for CVE-2026-24735

Vulnerability Analysis

This vulnerability is classified under CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). The flaw exists in an API endpoint within Apache Answer that handles content revision history. When content is deleted by users or administrators, the revision history associated with that content remains accessible through this unauthenticated API endpoint. This represents a significant information disclosure risk, as deleted content often contains sensitive information that organizations expect to be permanently removed from access.

The network-based attack vector requires no privileges or user interaction, making this vulnerability particularly dangerous for public-facing Apache Answer deployments. An attacker can systematically query the vulnerable endpoint to harvest previously deleted content, including earlier revisions of answers, questions, or comments that may contain confidential information.

Root Cause

The root cause is an authorization bypass in the API endpoint responsible for serving revision history. The endpoint fails to verify authentication status before returning revision data, and additionally does not check whether the associated content has been deleted. This dual failure in access control allows any remote attacker to retrieve content that should be restricted to authenticated administrators or completely inaccessible following deletion.

Attack Vector

The attack exploits the network-accessible API endpoint with no authentication requirements. An attacker can send HTTP requests to the vulnerable endpoint to enumerate and retrieve revision history for deleted content. The attack requires no special privileges, no user interaction, and can be automated to systematically extract large amounts of previously deleted information from vulnerable Apache Answer instances.

Since no verified code examples are available for this vulnerability, security teams should refer to the Apache Security Thread and Openwall OSS Security Discussion for technical details on the vulnerable API endpoint behavior and exploitation methodology.

Detection Methods for CVE-2026-24735

Indicators of Compromise

• Unusual API request patterns targeting revision history endpoints, particularly for content IDs that no longer exist in active content
• High volume of requests to revision-related API endpoints from unauthenticated sessions
• Access logs showing enumeration attempts against sequential content or revision identifiers
• Requests to revision endpoints from IP addresses not associated with legitimate users

Detection Strategies

• Monitor web server access logs for unauthenticated requests to API endpoints containing /revision/ or similar revision history paths
• Implement rate limiting detection for rapid sequential requests to revision endpoints
• Deploy web application firewall (WAF) rules to detect and alert on revision history enumeration patterns
• Configure SIEM alerts for high-frequency API requests from single sources targeting content revision endpoints

Monitoring Recommendations

• Enable detailed logging for all API endpoint access, including authentication status and response codes
• Establish baseline metrics for revision API usage to identify anomalous access patterns
• Monitor for requests returning deleted content identifiers in response payloads
• Review access patterns to revision endpoints during off-hours or from geographic locations outside normal user activity

How to Mitigate CVE-2026-24735

Immediate Actions Required

• Upgrade Apache Answer to version 2.0.0 or later immediately
• Audit access logs for signs of prior exploitation targeting revision history endpoints
• Review deleted content that may have been exposed and assess the sensitivity of potentially compromised information
• Consider implementing network-level access controls to restrict API access while preparing for upgrade

Patch Information

Apache has released version 2.0.0 of Apache Answer which addresses this vulnerability. Users are strongly recommended to upgrade immediately. The fix implements proper authentication checks on the revision history API endpoint and ensures deleted content revisions are no longer accessible.

For additional details, see the Apache Security Thread.

Workarounds

• Implement a reverse proxy or WAF rule to block unauthenticated requests to revision history API endpoints
• Restrict network access to the Apache Answer API to trusted IP ranges if remote access is not required
• Temporarily disable or rate-limit the revision history API endpoint if the feature is not critical for operations

# Example nginx configuration to block unauthenticated revision API access
location ~ /api/v1/.*/revision {
    # Require authentication header or block request
    if ($http_authorization = "") {
        return 403;
    }
    proxy_pass http://apache_answer_backend;
}