CVE-2026-34905: Apache Answer Information Disclosure Flaw

CVE-2026-34905 Overview

CVE-2026-34905 is an information disclosure vulnerability in Apache Answer, an open-source question-and-answer platform. The flaw affects all versions through 2.0.0 and stems from missing access controls on direct API endpoints serving unlisted questions. Authenticated users can enumerate and retrieve unlisted questions, their answers, comments, and revision history, despite the unlisted feature being intended to hide such content from general visibility. The issue is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Apache resolved the issue in version 2.0.1.

Critical Impact
Authenticated users can bypass the unlisted question visibility control and access confidential Q&A content through direct API calls, breaking the platform's content access model.

Affected Products

Apache Answer versions up to and including 2.0.0
Self-hosted Apache Answer deployments exposing the REST API
Multi-tenant Apache Answer instances relying on unlisted questions for private content

Discovery Timeline

2026-06-09 - CVE-2026-34905 published to NVD
2026-06-10 - Last updated in NVD database

Technical Details for CVE-2026-34905

Vulnerability Analysis

Apache Answer provides an unlisted question feature intended to hide questions from public lists and search results while still allowing access through direct links. The web interface honored this restriction, but the underlying REST API endpoints did not enforce equivalent access checks. Authenticated users issuing direct API requests could enumerate or retrieve unlisted questions and all associated data, including answers, comments, and revision history.

The attack requires network access, low privileges (any authenticated account), and no user interaction. The impact is limited to confidentiality, with no integrity or availability consequences. EPSS data places the probability of observed exploitation at a low level.

Root Cause

The root cause is a broken access control pattern where authorization logic was implemented at the presentation layer rather than uniformly enforced at the API layer. The unlisted flag filtered content from listing endpoints and UI surfaces but was not validated on direct object access endpoints. This is a classic insecure direct object reference pattern where one access channel applies a restriction that another channel omits.

Attack Vector

An authenticated attacker with any user role on the target Apache Answer instance can issue HTTP requests directly to question, answer, comment, and revision API endpoints using known or guessed question identifiers. Question identifiers in Apache Answer are sequential or otherwise enumerable, making discovery practical. The attacker bypasses the UI-level filtering entirely. No exploit code or proof of concept has been publicly released, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Apache Mailing List Discussion and the Openwall OSS Security Update for advisory details.

Detection Methods for CVE-2026-34905

Indicators of Compromise

Unusual volume of authenticated API requests to question, answer, or revision endpoints from a single user account
Sequential enumeration patterns against question identifier parameters in API access logs
API requests returning question data for identifiers that do not appear in any user-facing listing response
Access by low-privilege accounts to revision history endpoints for content they did not author

Detection Strategies

Compare web UI listing endpoint responses to direct API endpoint responses to flag any identifier returned by the API but not by the listing
Implement server-side audit logging that records the unlisted flag of each question accessed via the API
Apply rate-limit alerting on per-user question identifier access frequency to surface enumeration

Monitoring Recommendations

Forward Apache Answer application and reverse proxy logs to a centralized SIEM for retention and correlation
Build a detection rule on identifier enumeration: many sequential or high-cardinality question identifier accesses by one account within a short window
Track access to revision history endpoints, which are lower-traffic and more diagnostic of reconnaissance behavior

How to Mitigate CVE-2026-34905

Immediate Actions Required

Upgrade Apache Answer to version 2.0.1 or later, which enforces access restrictions on direct API endpoints
Audit access logs for the past retention window to identify accounts that accessed unlisted question identifiers
Notify content owners whose unlisted questions may have been disclosed and review whether sensitive data requires rotation

Patch Information

Apache released Apache Answer 2.0.1 to remediate CVE-2026-34905. The fix enforces unlisted question access checks at the API layer so that all access paths apply consistent authorization. Patch details and discussion are available in the Apache Mailing List Discussion and the Openwall OSS Security Update.

Workarounds

Restrict Apache Answer registration to trusted users to reduce the population of authenticated accounts that can exploit the flaw
Place sensitive content in a separate, access-controlled instance rather than relying on the unlisted feature until the upgrade is applied
Apply a reverse proxy access control list to the question, answer, comment, and revision API endpoints, blocking requests from low-privilege user roles where feasible

bash

# Configuration example: upgrade Apache Answer via Docker
docker pull apache/answer:2.0.1
docker stop answer && docker rm answer
docker run -d \
  --name answer \
  -p 9080:80 \
  -v answer-data:/data \
  apache/answer:2.0.1