GHSA-5w5r-8xc6-2xhw

Source

https://github.com/advisories/GHSA-5w5r-8xc6-2xhw

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-5w5r-8xc6-2xhw/GHSA-5w5r-8xc6-2xhw.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-5w5r-8xc6-2xhw

Aliases

Published

2026-02-04T12:31:25Z

Modified

2026-02-05T03:56:03.546347Z

Severity

7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
6.6 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U CVSS Calculator

Summary

Apache Answer Exposure of Private Personal Information to an Unauthorized Actor vulnerability

Details

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 1.7.1.

An unauthenticated API endpoint incorrectly exposes full revision history for deleted content. This allows unauthorized users to retrieve restricted or sensitive information. Users are recommended to upgrade to version 2.0.0, which fixes the issue.

Database specific

{
    "nvd_published_at": "2026-02-04T11:16:03Z",
    "cwe_ids": [
        "CWE-359"
    ],
    "github_reviewed_at": "2026-02-04T20:32:50Z",
    "severity": "MODERATE",
    "github_reviewed": true
}

References

Affected packages

Go / github.com/apache/answer

Package

Name: github.com/apache/answer; View open source insights on deps.dev
Purl: pkg:golang/github.com/apache/answer

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.0.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-5w5r-8xc6-2xhw/GHSA-5w5r-8xc6-2xhw.json"

last_known_affected_version_range

"<= 1.7.1"