CVE-2026-24735: 
vulnerability analysis and mitigation

CVE-2026-24735 is an information disclosure vulnerability in Apache Answer, classified as "Exposure of Private Personal Information to an Unauthorized Actor" (CWE-359). An unauthenticated API endpoint incorrectly exposes the full revision history for deleted content, allowing unauthorized users to retrieve restricted or sensitive information. The vulnerability affects Apache Answer through version 1.7.1, and was publicly disclosed on February 4, 2026, with a fix available in version 2.0.0. It carries a CVSS v3.1 base score of 7.5 (High) (Apache Mailing List, oss-security).

The root cause is improper access control on the Revision API endpoint (CWE-359), which fails to enforce authentication or authorization checks before returning revision history data. Specifically, the API endpoint exposes the full edit/revision history of content that has been deleted by users or administrators, meaning data intended to be removed remains accessible. An attacker can exploit this by sending unauthenticated HTTP requests directly to the revision history API endpoint, requiring no credentials, special privileges, or user interaction. The vulnerability was reported by Sho Odagiri of GMO Cybersecurity by Ierae, Inc. (oss-security, Apache Mailing List).

Successful exploitation allows any unauthenticated remote attacker to retrieve the full revision history of deleted posts, answers, or questions from an Apache Answer instance. This may expose sensitive or confidential information that users or administrators believed had been permanently removed, including potentially personal data, internal discussions, or proprietary content. There is no integrity or availability impact; the risk is confined to confidentiality, but the exposure of deleted content could have significant privacy and compliance implications for organizations using Apache Answer as a knowledge-sharing platform (Apache Mailing List, oss-security).

1. Reconnaissance: Identify publicly accessible Apache Answer instances (versions through 1.7.1) using search engines, Shodan, or Censys by fingerprinting the application's login page or API responses.
2. Identify the Revision API endpoint: Locate the unauthenticated revision history API endpoint within the Apache Answer application (e.g., an endpoint such as /api/v1/revisions or similar, based on the application's API structure).
3. Send unauthenticated request: Issue an HTTP GET request to the revision history endpoint without any authentication headers or session tokens, specifying the target content ID (e.g., a deleted question or answer).
4. Retrieve deleted content history: Parse the API response, which incorrectly returns the full revision history — including all prior versions of deleted content — exposing sensitive or restricted information to the attacker (oss-security, Apache Mailing List).

• Network: Unusual or repeated unauthenticated HTTP GET requests to the Apache Answer revision/history API endpoints (e.g., paths containing /revisions or /revision) from external or unexpected IP addresses.
• Logs: Web server or application access logs showing requests to revision API endpoints without associated authentication tokens or session cookies, particularly for content IDs corresponding to deleted posts.
• Logs: High volume of API requests to revision endpoints from a single IP address, potentially indicating automated enumeration of deleted content.

The Apache Software Foundation has released version 2.0.0 of Apache Answer, which fixes this vulnerability by enforcing proper access controls on the revision history API endpoint. All users running Apache Answer through version 1.7.1 are strongly recommended to upgrade to version 2.0.0 immediately. No configuration-based workaround has been officially documented; upgrading is the only confirmed remediation (oss-security, Apache Mailing List).

The vulnerability was discussed on the oss-security mailing list and received coverage from security news outlets including SecurityOnline.info and TheHackerWire. Social media posts on Bluesky and Mastodon noted the disclosure. Community reaction was moderate, with the primary concern being the ease of exploitation due to the lack of authentication requirements, though the limited deployment footprint of Apache Answer tempered broader alarm (oss-security, SecurityOnline).