CVE-2026-34905: apache software foundation apache answer
Vulnerability summary
CVE-2026-34905 is a medium (CVSS 6.5) vulnerability in apache software foundation apache answer. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 09-06-2026PublishedVulnerability first disclosed.
- 09-06-2026Last modifiedVulnerability information updated.
Description
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. The unlisted question feature did not enforce access restrictions on direct API endpoints, allowing authenticated users to discover and access unlisted questions, their answers, comments, and revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · GoEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
42%
Versus all other CVEs
30-day change
+0.20 pp
From 0.31% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Github.com/apache2 products
- answer< 1.7.2-0.20260509071350-11c80384f13a
- incubator-answer< 1.7.2-0.20260509071350-11c80384f13a
Apache1 product
- answer< 2.0.1
Apache software foundation1 product
- apache answer≤ 2.0.0
3 vendors · 4 products
References
7 links- lists.apache.org/thread/khxoft96sptr2kh0cpzgw7f6qwv0ltcfVendor AdvisoryWEBMailing ListThird Party Advisory
- github.com/apache/answerPACKAGE