CVE-2026-60023: Apache Answer Information Disclosure Flaw

CVE-2026-60023 Overview

CVE-2026-60023 is an information disclosure vulnerability in Apache Answer, an open-source question-and-answer platform. The flaw affects all releases through version 2.0.1 and is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.

The vulnerability allows unauthorized users to retrieve deleted or pending answers through the single-answer read path when the parent question remains visible. Content that moderators intended to hide, including pending or removed answers, becomes accessible to actors who should not see it. Apache has released version 2.0.2 to address the issue.

Critical Impact
Unauthorized actors can retrieve deleted or pending answer content in Apache Answer, undermining moderation controls and exposing information that should remain hidden.

Affected Products

Apache Answer versions through 2.0.1
Apache Answer 2.0.1 and all prior releases
Fixed in Apache Answer 2.0.2

Discovery Timeline

2026-08-05 - CVE CVE-2026-60023 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-60023

Vulnerability Analysis

Apache Answer serves community-driven questions and answers, with moderators and authors able to delete answers or leave them in a pending state. Both actions should remove the content from public view. The application enforces this correctly on aggregate views such as the question thread, but the single-answer read path does not apply the same visibility check.

When the parent question is publicly visible, the API path that returns a single answer by identifier returns the answer body regardless of its moderation status. An unauthenticated or low-privileged user who knows or guesses an answer identifier can retrieve content that has been deleted or has not passed review. The exposed data includes the full answer body written by another user.

Root Cause

The root cause is an authorization gap in the single-answer read handler. The handler verifies that the parent question is accessible, but it does not verify the visibility status of the specific answer being requested. Access control checks are inconsistent between the list-answers path and the single-answer path, a common source of CWE-200 information disclosure issues.

Attack Vector

Exploitation requires no authentication beyond what is needed to view the parent question. An attacker enumerates or guesses answer identifiers and issues requests to the single-answer read endpoint. Successful requests return content marked as deleted or pending. No specialized tooling or memory-corruption primitive is required. The vulnerability is a logic flaw exposed through the normal HTTP API surface.

See the Apache Mailing List Thread and the Openwall OSS Security Update for the coordinated disclosure details.

Detection Methods for CVE-2026-60023

Indicators of Compromise

Access log entries showing repeated GET requests to single-answer endpoints with sequential or enumerated answer identifiers
Requests to answer read paths that succeed with HTTP 200 while the corresponding answer is marked deleted or pending in the database
Unusual volumes of single-answer read traffic from a small set of source IP addresses or user agents

Detection Strategies

Compare application access logs against the moderation state of returned answers to find reads of non-public content
Instrument the single-answer read handler to log the resolved answer status and alert when deleted or pending content is served
Correlate web server logs with database audit trails to identify anonymous or low-privilege sessions reading moderated content

Monitoring Recommendations

Monitor for enumeration patterns targeting the /answer API surface, including sequential identifier requests from a single source
Track deployed Apache Answer versions across the environment and flag any instance still running 2.0.1 or earlier
Alert on outbound traffic patterns consistent with scraping the answer endpoint, such as sustained high-rate GET requests

How to Mitigate CVE-2026-60023

Immediate Actions Required

Upgrade Apache Answer to version 2.0.2, which contains the fix for the single-answer read path
Inventory all Apache Answer deployments, including self-hosted and container-based installations, to confirm patched versions
Review access logs for prior enumeration of the single-answer endpoint and assess exposure of deleted or pending content

Patch Information

Apache has released Apache Answer 2.0.2 to remediate CVE-2026-60023. The fix enforces the answer-level visibility check on the single-answer read path so that deleted or pending answers are no longer returned to unauthorized users. Refer to the Apache Mailing List Thread for the official announcement and upgrade guidance.

Workarounds

If immediate upgrade is not possible, restrict access to the single-answer read endpoint at the reverse proxy or web application firewall layer until the patch is applied
Reduce anonymous read access to the Apache Answer instance where policy allows, limiting exposure to authenticated users
Purge or reassign identifiers of previously deleted answers where feasible to reduce the value of enumeration against unpatched instances

bash

# Configuration example: upgrade Apache Answer to 2.0.2
# Docker deployment
docker pull apache/answer:2.0.2
docker stop answer && docker rm answer
docker run -d --name answer -p 9080:80 -v answer-data:/data apache/answer:2.0.2

# Verify version after upgrade
curl -s http://localhost:9080/answer/api/v1/siteinfo | grep -i version