CVE-2026-79620: Apache Answer Information Disclosure Flaw

CVE-2026-79620 is an information disclosure vulnerability in Apache Answer that allows authenticated users to view metadata of non-public questions through improper authorization in similar-question search. This post covers technical details, affected versions, impact assessment, and mitigation steps.

CVE-2026-79620 Overview

CVE-2026-79620 is an information disclosure vulnerability in Apache Answer, an open-source question and answer platform. The flaw resides in the similar-question search feature, where an improper authorization check allows authenticated users to view metadata belonging to non-public questions. The issue affects all versions through 2.0.2 and is categorized under [CWE-202: Exposure of Sensitive Information Through Data Queries]. Apache has released version 2.0.3 to address the problem.

Critical Impact
Authenticated users can access metadata from private questions that should be restricted, leading to unintended disclosure of confidential discussions.

Affected Products

Apache Answer versions through 2.0.2
Apache Answer deployments exposing the similar-question search endpoint
Any Apache Answer instance with non-public questions and authenticated user access

Discovery Timeline

2026-10-19 - CVE-2026-79620 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-79620

Vulnerability Analysis

The vulnerability stems from a missing authorization check inside Apache Answer's similar-question search function. When a user submits a query, the backend searches across all questions to find semantic or textual matches. The search routine does not filter results based on the visibility state of the matched questions. As a result, metadata from non-public questions, which may include titles, snippets, authors, or tags, is returned to any authenticated requester.

This class of issue, tracked as [CWE-202], occurs when sensitive data is leaked through indirect query mechanisms rather than direct resource access. The direct read endpoints for private questions remain protected, but the search path bypasses those controls. Attackers do not need elevated privileges, only a valid authenticated session.

Root Cause

The root cause is an improper authorization check in the similar-question search handler. The function retrieves candidate matches from the data store without applying the visibility filter that governs normal question listings. The access control decision is made at the question-detail layer rather than at the query layer, leaving the search path unguarded.

Attack Vector

An authenticated user submits a crafted question or search term designed to match tokens likely to appear in private questions. The similar-question endpoint returns matching entries, including metadata from questions the user is not authorized to view. Repeated queries with varied keywords can enumerate restricted content across the platform. No exploit code is published, and no public proof of concept is listed in the advisory.

See the Apache Security Discussion Thread and the Openwall OSS Security Update for the vendor's technical details.

Detection Methods for CVE-2026-79620

Indicators of Compromise

Elevated query volume against the similar-question search endpoint from a single authenticated account
Search requests containing keywords aligned with known private question topics or tags
Access patterns where users surface metadata for question IDs they never visit directly

Detection Strategies

Audit application logs for repeated similar-question search calls paired with unusual response payload sizes
Correlate authenticated session identifiers with questions whose visibility is set to non-public to spot unexpected exposure
Review API gateway telemetry for enumeration-style query sequences from low-privilege accounts

Monitoring Recommendations

Enable verbose logging on the search and question-retrieval handlers in Apache Answer
Ingest Apache Answer application and web server logs into a centralized analytics platform for correlation
Alert on sudden increases in distinct question IDs returned to a single user within a short window

How to Mitigate CVE-2026-79620

Immediate Actions Required

Upgrade Apache Answer to version 2.0.3, which contains the authorization fix
Inventory all Apache Answer deployments, including staging and internal instances, and confirm their patch state
Rotate or review any sensitive content that may have been exposed through the similar-question endpoint

Patch Information

Apache has released Apache Answer version 2.0.3, which corrects the authorization check in the similar-question search path. Administrators should upgrade from any version through 2.0.2 as the primary remediation. Refer to the Apache Security Discussion Thread for release details.

Workarounds

Restrict access to the Apache Answer instance to trusted users until the upgrade is applied
Temporarily disable or front the similar-question search endpoint with a reverse proxy rule that blocks unauthenticated and low-trust accounts
Reduce the number of non-public questions on affected instances until patching is complete

bash

# Configuration example
# Upgrade Apache Answer using Docker
docker pull apache/answer:2.0.3
docker stop answer
docker rm answer
docker run -d --name answer -p 9080:80 -v answer-data:/data apache/answer:2.0.3