CVE-2026-25699— Apache Answer: Authorization Bypass in Timeline API
Possible ATT&CK Techniques 1AI
T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Apache Software Foundation | Apache Answer | ≤ 2.0.0 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-25699
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Apache Answer: Authorization Bypass in Timeline API
Source: NVD (National Vulnerability Database)
Vulnerability Description
Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.0. Timeline-related APIs lacked proper authorization checks, allowing regular authenticated users to access deleted, private, or unapproved content and its revision history. Users are recommended to upgrade to version 2.0.1, which fixes the issue.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
侵犯隐私
Source: NVD (National Vulnerability Database)
Vulnerability Title
Apache Answer 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Apache Answer是美国阿帕奇（Apache）基金会的一个社区平台。 Apache Answer 2.0.0及之前版本存在安全漏洞，该漏洞源于时间线相关API缺乏适当授权检查，可能导致普通认证用户访问已删除、私有或未批准内容及其修订历史，导致私人信息泄露给未经授权的行为者。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Apache Software Foundation | Apache Answer | 0 ~ 2.0.0 | - |
II. Public POCs for CVE-2026-25699
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-25699
请登录查看更多情报信息。
Mailing List Discussions for CVE-2026-25699 (1)
Same Patch Batch · Apache Software Foundation · 2026-06-09 · 7 CVEs total
| CVE-2026-49818 | Apache Airflow Samba provider: Path traversal in GCSToSambaOperator via GCS object names | |
| CVE-2026-34905 | Apache Answer: Unlisted Questions Accessible via Direct API Access | |
| CVE-2026-34033 | Apache Answer: HTML Content Injection in Email | |
| CVE-2026-34031 | Apache Answer: The custom avatar was not properly validated | |
| CVE-2026-33582 | Apache Answer: Uploading specially crafted TIFF files causes an Out-of-Memory error | |
| CVE-2026-25688 | Apache Answer: XSS in AI Answer Rendering |
IV. Related Vulnerabilities
Same product: Apache Answer
- CVE-2026-25700
Apache Answer: AdminToken not invalidated after admin deacti - CVE-2026-34905
Apache Answer: Unlisted Questions Accessible via Direct API - CVE-2026-34033
Apache Answer: HTML Content Injection in Email - CVE-2026-34031
Apache Answer: The custom avatar was not properly validated - CVE-2026-33582
Apache Answer: Uploading specially crafted TIFF files causes
Same vendor: Apache Software Foundation
- CVE-2026-43825
Apache OpenNLP :: Core :: ML :: LibSVM: Unsafe Java Deserial - CVE-2026-49297
Apache Airflow Google provider: Path traversal via GCS objec - CVE-2026-46588
Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers b - CVE-2026-46587
Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers - CVE-2026-49042
Apache Camel: langchain4j-tools: filter tool argument header
Same weakness: CWE-359
- CVE-2026-58297
Microsoft Edge for Android Information Disclosure Vulnerabil - CVE-2026-58296
Microsoft Edge for Android Information Disclosure Vulnerabil - CVE-2026-57960
Hi.Events 1.9.0 - Unauthenticated Attendee PII Exposure via - CVE-2026-56124
phpUploader < 2.0.2 Unauthenticated Database Exposure via in - CVE-2026-48615
nodejs node.js 信息泄露漏洞
V. Comments for CVE-2026-25699
No comments yet