# CVE-2026-34905: Apache Answer information disclosure in unlisted questions feature

Source: https://junglewise.ai/threats/cve-2026-34905-apache-answer-information-disclosure-in-unlisted-questions  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-09. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-34905 · Severity: medium · CVSS 6.5 · Published 2026-06-09

Apache Answer, a community-driven Q&A platform, contains a security flaw where 'unlisted' questions are not properly protected. Any logged-in user can bypass intended visibility restrictions to view private questions, their answers, comments, and edit history. This could lead to the unauthorized disclosure of sensitive internal discussions or private information.

Technologies: [Apache Software Foundation Answer](https://junglewise.ai/threats/technologies/answer), [github.com/apache/answer (Go)](https://junglewise.ai/threats/technologies/github-com-apache-answer), [github.com/apache/incubator-answer (Go)](https://junglewise.ai/threats/technologies/github-com-apache-incubator-answer). Vendors: [Apache Software Foundation](https://junglewise.ai/threats/vendors/apache-software-foundation), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-34905 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34905 being exploited in the wild.

**How severe is CVE-2026-34905?** Medium severity, with a CVSS score of 6.5, published 9 June 2026.

**Which products and versions are affected?** Apache Software Foundation Answer through 2.0.0; github.com/apache/answer (Go) SEMVER:introduced=0,fixed=1.7.2-0.20260509071350-11c80384f13a; github.com/apache/incubator-answer (Go) < 1.7.2-0.20260509071350-11c80384f13a, SEMVER:introduced=0,fixed=1.7.2-0.20260509071350-11c80384f13a.

**Is there a fix for CVE-2026-34905?** Yes. github.com/apache/answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later; github.com/apache/incubator-answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34905 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-34905?** Check whether you run Apache Software Foundation Answer, github.com/apache/answer (Go) or github.com/apache/incubator-answer (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/apache/answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later

  ```sh
  go get github.com/apache/answer@v1.7.2-0.20260509071350-11c80384f13a
  ```

- github.com/apache/incubator-answer (Go): upgrade to 1.7.2-0.20260509071350-11c80384f13a or later

  ```sh
  go get github.com/apache/incubator-answer@v1.7.2-0.20260509071350-11c80384f13a
  ```


## Technical details

An information disclosure vulnerability exists in Apache Answer's 'unlisted question' feature due to missing authorization checks on direct API endpoints. While these questions are hidden from the standard web UI, the underlying API does not validate if the requesting authenticated user has the permission to view unlisted content. An attacker with a valid account can query these endpoints to retrieve unlisted questions, answers, comments, and revision history. The issue is resolved in version 2.0.1 by enhancing visibility checks in the answer and comment services to include administrator and moderator validation.

## Affected products

- Apache Answer through 2.0.0

## Identifiers

- CVE-2026-34905
- GHSA-85r2-pvg8-89r9
- GO-2026-6152

## Timeline

- 2026-05-09: patched: Fix committed to repository
- 2026-06-09: disclosed: Public advisory released

## References

- [https://lists.apache.org/thread/khxoft96sptr2kh0cpzgw7f6qwv0ltcf](https://lists.apache.org/thread/khxoft96sptr2kh0cpzgw7f6qwv0ltcf)
- [http://www.openwall.com/lists/oss-security/2026/06/09/2](http://www.openwall.com/lists/oss-security/2026/06/09/2)
- [https://github.com/apache/answer/commit/11c80384f13a27e27c871c05bb353489d1363ee2](https://github.com/apache/answer/commit/11c80384f13a27e27c871c05bb353489d1363ee2)
- [https://github.com/apache/answer/releases/tag/v2.0.1](https://github.com/apache/answer/releases/tag/v2.0.1)

## Related threats

- [Apache Answer improper security token invalidation for administrative accounts](https://junglewise.ai/threats/cve-2026-25700-apache-answer-improper-security-token-invalidation-for)
- [Apache Answer XSS in notification emails](https://junglewise.ai/threats/cve-2026-34033-apache-answer-xss-in-notification-emails)
- [Apache Answer unrestricted upload in profile image URLs](https://junglewise.ai/threats/cve-2026-34031-apache-answer-unrestricted-upload-in-profile-image-urls)
- [Apache Answer denial of service via crafted TIFF upload](https://junglewise.ai/threats/cve-2026-33582-apache-answer-denial-of-service-via-crafted-tiff-upload)
- [Apache Answer information disclosure in timeline APIs](https://junglewise.ai/threats/cve-2026-25699-apache-answer-information-disclosure-in-timeline-apis)