Key points
- Apache Answer versions through 2.0.2 contain CVE-2026-76994, a moderate severity vulnerability.
- The flaw allows unauthenticated attackers to view metadata from hidden questions via public profiles.
- Version 2.0.3 is available and fixes the issue, restoring proper access controls.
Apache Answer users running versions up to and including 2.0.2 must upgrade to version 2.0.3. The new release addresses CVE-2026-76994, a moderate vulnerability that exposes sensitive metadata. According to an advisory on the oss-security mailing list, the flaw allows unauthorized actors to access information they should not see. This issue affects installations that have not yet applied the latest patch from the Apache Software Foundation.
In plain English
The vulnerability lets anyone on the internet see details about questions that were supposed to be hidden. Attackers do not need a login to do this. They can simply visit public answer profiles on your site. From there, they can extract metadata associated with those hidden questions. This breaks the privacy expectations of users who marked their questions as non-public.
The background
Security researcher Enxin Xie reported this issue on October 15. The advisory was published on the oss-security mailing list. This follows a previous finding by Patch Herald on October 16 regarding CVE-2026-79613, which leaked private comments in the same software versions. That earlier flaw was also fixed in version 2.0.3. Credit for finding this new metadata leak goes to the researcher known as sec-reex.
What changes now
Administrators can now deploy version 2.0.3 to close this data exposure gap. The update restores the intended visibility settings for hidden content. Users no longer need to worry about their question metadata appearing on public profiles. This patch resolves the specific issue identified in CVE-2026-76994. It ensures that only authorized viewers can access sensitive information linked to hidden questions.
Who needs to act first
Teams managing public-facing Apache Answer instances should prioritize updating exposed servers immediately. Before applying the update, verify that the current version is indeed 2.0.2 or earlier. Roll out the patch to a test environment first to ensure compatibility with existing plugins. Back up your current database and configuration files before making changes. Monitor error logs after the update to confirm that public profiles no longer reveal hidden metadata.
What to do and how to stay safe: Apache Answer
- Verify your Apache Answer installation is running version 2.0.2 or older.
- Download and install version 2.0.3 from the official Apache repository.
- Review public answer profiles after updating to confirm hidden data is no longer visible.
- Check your server logs for any signs of unauthorized access attempts prior to the patch.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-76994?
It is a moderate vulnerability in Apache Answer that exposes hidden question metadata through public answer profiles.
Which versions are affected?
Apache Answer versions through 2.0.2 are affected by this vulnerability.
Is there a fix available?
Yes, users are recommended to upgrade to version 2.0.3, which fixes the issue.
