Is CVE-2026-34905 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34905 being exploited in the wild.

How severe is CVE-2026-34905?

Medium severity, with a CVSS score of 6.5, published 9 June 2026.

Which products and versions are affected?

Apache Software Foundation Answer through 2.0.0; github.com/apache/answer (Go) SEMVER:introduced=0,fixed=1.7.2-0.20260509071350-11c80384f13a; github.com/apache/incubator-answer (Go) < 1.7.2-0.20260509071350-11c80384f13a, SEMVER:introduced=0,fixed=1.7.2-0.20260509071350-11c80384f13a.

Is there a fix for CVE-2026-34905?

Yes. github.com/apache/answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later; github.com/apache/incubator-answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34905 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-34905?

Check whether you run Apache Software Foundation Answer, github.com/apache/answer (Go) or github.com/apache/incubator-answer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34905: Apache Answer information disclosure in unlisted questions feature

Q: Is there a fix for CVE-2026-34905?

Yes. github.com/apache/answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later; github.com/apache/incubator-answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-34905 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-34905?

Check whether you run Apache Software Foundation Answer, github.com/apache/answer (Go) or github.com/apache/incubator-answer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34905 · Severity: medium · CVSS 6.5 · Published 2026-06-09

Apache Answer, a community-driven Q&A platform, contains a security flaw where 'unlisted' questions are not properly protected. Any logged-in user can bypass intended visibility restrictions to view private questions, their answers, comments, and edit history. This could lead to the unauthorized disclosure of sensitive internal discussions or private information.

Technologies: Apache Software Foundation Answer, github.com/apache/answer (Go), github.com/apache/incubator-answer (Go). Vendors: Apache Software Foundation, Go.

Quick answers

Is CVE-2026-34905 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34905 being exploited in the wild.
How severe is CVE-2026-34905?: Medium severity, with a CVSS score of 6.5, published 9 June 2026.
Which products and versions are affected?: Apache Software Foundation Answer through 2.0.0; github.com/apache/answer (Go) SEMVER:introduced=0,fixed=1.7.2-0.20260509071350-11c80384f13a; github.com/apache/incubator-answer (Go) < 1.7.2-0.20260509071350-11c80384f13a, SEMVER:introduced=0,fixed=1.7.2-0.20260509071350-11c80384f13a.
Is there a fix for CVE-2026-34905?: Yes. github.com/apache/answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later; github.com/apache/incubator-answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34905 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-34905?: Check whether you run Apache Software Foundation Answer, github.com/apache/answer (Go) or github.com/apache/incubator-answer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/apache/answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later
```
go get github.com/apache/answer@v1.7.2-0.20260509071350-11c80384f13a
```
github.com/apache/incubator-answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later
```
go get github.com/apache/incubator-answer@v1.7.2-0.20260509071350-11c80384f13a
```

Technical details

An information disclosure vulnerability exists in Apache Answer's 'unlisted question' feature due to missing authorization checks on direct API endpoints. While these questions are hidden from the standard web UI, the underlying API does not validate if the requesting authenticated user has the permission to view unlisted content. An attacker with a valid account can query these endpoints to retrieve unlisted questions, answers, comments, and revision history. The issue is resolved in version 2.0.1 by enhancing visibility checks in the answer and comment services to include administrator and moderator validation.

Affected products

Apache Answer through 2.0.0

Identifiers

CVE-2026-34905
GHSA-85r2-pvg8-89r9
GO-2026-6152

Timeline

2026-05-09: patched: Fix committed to repository
2026-06-09: disclosed: Public advisory released

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.