Executive brief
Apache Answer is an open-source Q&A platform used by organizations to build knowledge-sharing communities. A security flaw in the platform's timeline features allowed standard users to bypass security restrictions and view private, deleted, or unapproved content. This could lead to the exposure of sensitive personal information or internal discussions that were intended to be hidden or removed.
Technical details
An authorization bypass vulnerability exists in Apache Answer versions through 2.0.0 within the timeline-related APIs. The root cause is a lack of proper authorization checks in the ActivityController, specifically within the GetObjectTimeline and GetObjectTimelineDetail functions. An authenticated attacker can exploit this by sending crafted requests to these APIs to access deleted, private, or unapproved content and its revision history. The vulnerability is addressed in version 2.0.1 by implementing mandatory visibility checks and verifying administrative/moderator privileges via middleware before returning timeline objects.
Affected products
- Apache Answer through 2.0.0
Timeline
- 2026-06-09: disclosed
- 2026-06-09: advisory
- 2026-02-06: patched: Fix committed to repository