GHSA-w754-5646-xq9j

Source

https://github.com/advisories/GHSA-w754-5646-xq9j

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-w754-5646-xq9j/GHSA-w754-5646-xq9j.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-w754-5646-xq9j

Aliases

Published

2026-06-09T09:32:07Z

Modified

2026-08-18T15:10:40Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Apache Answer has an Exposure of Private Personal Information to an Unauthorized Actor vulnerability

Details

Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer.

This issue affects Apache Answer: through 2.0.0.

Timeline-related APIs lacked proper authorization checks, allowing regular authenticated users to access deleted, private, or unapproved content and its revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.

Database specific

{
    "cwe_ids":  [
        "CWE-359"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-30T18:31:50Z",
    "nvd_published_at":  "2026-06-09T09:16:28Z",
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/apache/incubator-answer

Package

Name: github.com/apache/incubator-answer; View open source insights on deps.dev
Purl: pkg:golang/github.com/apache/incubator-answer

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.2-0.20260206073245-92994b49976b

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-w754-5646-xq9j/GHSA-w754-5646-xq9j.json"